A stored cross‑site scripting flaw exists in the Altium Enterprise Server Workflow Engine caused by missing server‑side sanitization of workflow form submissions. An authenticated user can inject arbitrary JavaScript into workflow data that is later rendered when an administrator opens the workflow. The injected script runs in the administrator’s browser context, enabling the attacker to create new administrator accounts, steal session tokens, and perform any administrative action. This vulnerability is a direct privilege escalation mechanism rooted in a client‑side scripting weakness (CWE-79) that yields complete control over privileged accounts (CWE-269).

Altium Enterprise Server version 8.0.1 is impacted. No other affected versions were specified in the advisory.

The baseline CVSS score of 8.0 indicates high impact, while the EPSS score of less than 1% suggests that exploit activity is currently very rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack path requires an authenticated non‑administrator to submit malicious workflow data and a separate step where an administrator opens the compromised workflow. Once the administrator views the data, the payload executes immediately in the admin’s browser session. Because the vulnerability depends on an additional privileged user action, the overall exploitation feasibility is moderate, but the resulting impact is severe.