CVE Feed

    Dashboard / CVE / CVE-2026-1181

    CVE-2026-1181

    Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.

    Published:Jan 19, 2026
    Last Modified:Apr 18, 2026
    EPS:Jan 19, 2026
    EPSS Score:0.00021
    CVSS Score:9

    Affected Products

    Vendor
    Altium
    Product
    Altium 365

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-14439 (CVSS 9.4) — A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Alti…
    CVE-2026-11431 (CVSS 8.3) — A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Se…
    CVE-2026-11429 (CVSS 10) — Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accep…
    CVE-2026-11424 (CVSS 8.3) — A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Ente…
    CVE-2026-9152 (CVSS 10) — A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes …
    CVE-2026-1011 (CVSS 6.1) — A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due …
    CVE-2026-1010 (CVSS 8) — A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-s…
    CVE-2026-1009 (CVSS 9) — A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input …
    CVE-2026-1008 (CVSS 7.6) — A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insuff…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High