CVE-2026-1181

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1181", "assignerOrgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "state": "PUBLISHED", "assignerShortName": "Altium", "dateReserved": "2026-01-19T11:47:00.514Z", "datePublished": "2026-01-19T12:00:10.265Z", "dateUpdated": "2026-01-26T21:20:18.423Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["Workspace API"], "platforms": ["Web"], "product": "Altium 365", "vendor": "Altium", "versions": [{"status": "affected", "version": "unspecified", "versionType": "semver"}]}], "datePublic": "2026-01-15T22:48:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments."}], "value": "Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments."}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}, {"capecId": "CAPEC-17", "descriptions": [{"lang": "en", "value": "CAPEC-17 Accessing, Modifying, or Executing Executable Files"}]}, {"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation via Trust Boundary Violation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-942", "description": "CWE-942 \u2013 Permissive Cross-domain Policy with Untrusted Domains", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "shortName": "Altium", "dateUpdated": "2026-01-26T21:20:18.423Z"}, "references": [{"url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "source": {"discovery": "UNKNOWN"}, "title": "Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T21:29:36.260341Z", "id": "CVE-2026-1181", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T21:29:42.528Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1181", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-20T21:29:36.260341Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T21:29:39.992Z"}}], "cna": {"title": "Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}, {"capecId": "CAPEC-17", "descriptions": [{"lang": "en", "value": "CAPEC-17 Accessing, Modifying, or Executing Executable Files"}]}, {"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation via Trust Boundary Violation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Altium", "modules": ["Workspace API"], "product": "Altium 365", "versions": [{"status": "affected", "version": "unspecified", "versionType": "semver"}], "platforms": ["Web"], "defaultStatus": "affected"}], "datePublic": "2026-01-15T22:48:00.000Z", "references": [{"url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.", "supportingMedia": [{"type": "text/html", "value": "Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-942", "description": "CWE-942 \u2013 Permissive Cross-domain Policy with Untrusted Domains"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "shortName": "Altium", "dateUpdated": "2026-01-26T21:20:18.423Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1181", "state": "PUBLISHED", "dateUpdated": "2026-01-26T21:20:18.423Z", "dateReserved": "2026-01-19T11:47:00.514Z", "assignerOrgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "datePublished": "2026-01-19T12:00:10.265Z", "assignerShortName": "Altium"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "modules": ["Workspace API"], "platforms": ["Web"], "product": "Altium 365", "vendor": "Altium", "versions": [{"status": "affected", "version": "unspecified", "versionType": "semver"}]}], "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments."}, {"lang": "es", "value": "Los puntos finales del espacio de trabajo de Altium 365 fueron configurados con una pol\u00edtica de Intercambio de Recursos de Origen Cruzado (CORS) excesivamente permisiva que permit\u00eda solicitudes de origen cruzado con credenciales desde otros subdominios controlados por Altium, incluyendo forum.live.altium.com. Como resultado, el JavaScript que se ejecutaba en esos or\u00edgenes pod\u00eda acceder a las API autenticadas del espacio de trabajo en el contexto de un usuario con sesi\u00f3n iniciada. Cuando se encadena con vulnerabilidades en esas aplicaciones externas, esta mala configuraci\u00f3n permite el acceso no autorizado a los datos del espacio de trabajo, acciones administrativas y la elusi\u00f3n de los controles de inclusi\u00f3n en lista blanca de IP, incluso en entornos GovCloud."}], "id": "CVE-2026-1181", "lastModified": "2026-06-17T10:15:16.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1181", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T21:29:36.260341Z", "version": "2.0.3"}}]}, "published": "2026-01-19T13:16:20.543", "references": [{"source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "sourceIdentifier": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-942"}], "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T19:04:52.220147+00:00", "value": {"mitigation_remediation": ["Reconfigure the CORS policy to allow credentialed requests only from authorized domains rather than all Altium\u2011controlled subdomains.", "Remove or disable any configuration that permits credentialed requests from forum.live.altium.com or other Altium\u2011controlled subdomains.", "Enforce IP allowlisting and verify that GovCloud deployments are not bypassed by the same CORS header.", "Audit and monitor cross\u2011origin requests for unexpected credentials.", "As a temporary workaround, block cross\u2011origin credentialed requests at the application firewall level until a vendor patch is available."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Workspace Access via Credentialed Cross-Origin Requests"}, "threat_synthesis": {"affected_systems": "The affected product is Altium 365, including deployments in standard and GovCloud environments. No specific product version numbers are listed; the issue applies to any instance exposing the described workspace endpoints. Subdomains controlled by Altium, like forum.live.altium.com, are implicitly included in the attack surface.", "description_and_impact": "Altium 365's workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing policy that allows credentialed requests from any Altium\u2011controlled subdomain, such as forum.live.altium.com. This misconfiguration permits JavaScript running on those origins to call authenticated workspace APIs on behalf of a logged\u2011in user. The vulnerability is a classic access control flaw (CWE\u2011284) combined with a CORS misconfiguration (CWE\u2011942).", "risk_and_exploitability": "The CVSS score of 9 indicates high severity, while the EPSS score of less than 1% suggests a low probability of public exploitation at the time of assessment. The vulnerability is not listed in CISA's KEV catalog, implying no current evidence of widespread exploitation. The likely attack vector is cross\u2011origin JavaScript injection via an allowed subdomain, often chained with existing vulnerabilities in those external applications to read or modify workspace data, perform administrative actions, and sidestep IP allowlisting controls."}}}}, "created": "2026-01-20T08:43:32.795060+00:00", "updated": "2026-04-18T19:15:10.604007+00:00", "vendors": ["altium", "altium$PRODUCT$altium_365"]}