Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Altium |
|
No data.
No data.
References
History
Wed, 21 Jan 2026 23:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-79 |
Wed, 21 Jan 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post. Successful exploitation allows the attacker’s payload to execute in the context of the victim’s authenticated Altium 365 session, enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires user interaction to view a malicious forum post. | Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments. |
| Title | Stored Cross-Site Scripting in Altium 365 Forum Leading to Cross-Customer Data Exposure | Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access |
| Weaknesses | CWE-942 |
Tue, 20 Jan 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 20 Jan 2026 08:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Altium
Altium altium 365 |
|
| Vendors & Products |
Altium
Altium altium 365 |
Mon, 19 Jan 2026 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post. Successful exploitation allows the attacker’s payload to execute in the context of the victim’s authenticated Altium 365 session, enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires user interaction to view a malicious forum post. | |
| Title | Stored Cross-Site Scripting in Altium 365 Forum Leading to Cross-Customer Data Exposure | |
| Weaknesses | CWE-284 CWE-79 |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Altium
Published: 2026-01-19T12:00:10.265Z
Updated: 2026-01-22T01:42:51.917Z
Reserved: 2026-01-19T11:47:00.514Z
Link: CVE-2026-1181
Vulnrichment
Updated: 2026-01-20T21:29:39.992Z
NVD
Status : Received
Published: 2026-01-19T13:16:20.543
Modified: 2026-01-21T23:15:52.023
Link: CVE-2026-1181
Redhat
No data.