CVE-2026-1181

Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access

State: Published
Severity: 9.0 Critical
Published: Jan 19, 2026
Updated: Jan 26, 2026
Reserved: Jan 19, 2026

Description

Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	Altium

Weaknesses

CWE-942 – Permissive Cross-domain Policy with Untrusted Domains
CWE-284 Improper Access Control

Affected Products

Product	Versions
Altium 365Altium	unspecifiedAffected

References

https://www.altium.com/platform/security-compliance/security-advisories

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.