CVEvulnerability

CVE-2026-1181

9.0 CRITICAL Published 2026-01-19 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2026-01-19
Last modified
2026-06-17
Assigner
4760f414-e1ae-4ff1-bdad-c7a9c3538b79
CVSS 3.1 (4760f414-e1ae-4ff1-bdad-c7a9c3538b79)
9.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-284, CWE-942

Description

Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains weakness

References