Paper/Archive/CVE-2026-1181

CVE-2026-1181

Altium Altium 365 — Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 28.7.287 × 205.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.

Affected

ProductAffectedFixed inSource

Altium 365unspecified–CNA

Scores by source

Altium (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refaltium.com/platform/security-compliance/security-advisories