A stored cross‑site scripting flaw in Altium Live Forum allows an authenticated user to inject arbitrary JavaScript into post content. The malicious script is stored and then executed when other users view the post. Because the script runs in the victim’s authenticated Altium 365 session, it can read sensitive workspace data including design files and settings, effectively granting the attacker unauthorized access to privileged information.

Altium Live version 1.2.2. No other affected versions are listed.

This vulnerability carries a CVSS score of 9, indicating high severity, while the EPSS probability is very low (< 1 %) and it is not listed in the KEV catalog. The attack requires an attacker to create a post containing the exploit and a victim to view that post, so interaction from the victim is necessary for execution. Once the script runs, it can read or exfiltrate sensitive data within the user’s authenticated session.