CVE-2026-1181CRITICAL 9.0EPSS p22.2%
CVE-2026-1181CVE-2026-1181
Description
Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.
Scoring
| CVSS 3.1 | 9.0 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| EPSS | 0.31% probability of exploitation · percentile 22.2% · 2026-06-18T12:00:27Z |
| Published | 2026-01-19 |
| Last modified | 2026-04-15 |
Underlying weaknesses· 2
References
2
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Improper Access Controlcwe-284 | 0% | live |
| Weakness | Permissive Cross-domain Security Policy with Untrusted Domainscwe-942 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.