CVE-2026-1010

CVE-2026-1010 is a stored cross-site scripting (XSS) vulnerability in Altium On-Prem Enterprise Server's Workflow Engine, stemming from inadequate input sanitization in workflow form submission APIs. A regular authenticated user can inject malicious JavaScript, which executes in an administrator's browser when they view the compromised workflow. This allows for privilege escalation, including creating new administrator accounts, stealing session tokens, and performing administrative actions. While rated Medium severity (CVSS 5.4), there is currently no public exploit code, Metasploit modules, or evidence of active exploitation, and it has received minimal community discussion or media coverage.