Which versions of Altium 365 are affected by CVE-2026-9152?

Altium 365 cloud customers face an immediate critical risk from an authentication bypass that allows unauthenticated attackers to access, modify, and delete engineering design data and intellectual…

How to fix or mitigate CVE-2026-9152?

Immediately within 24 hours, contact Altium Support to confirm your organization's Altium 365 cloud usage and request interim mitigations; simultaneously enable audit logging of SearchService access if available in your tenant. Over the following week, implement network-level access controls to restrict SearchService endpoints where your infrastructure permits, conduct an audit of logs for suspicious activity since disclosure, and restrict workspace identifier distribution to essential personnel. Within 30 days, coordinate with Altium to confirm patch availability and timeline, conduct forensic review of all search logs to identify any unauthorized access attempts, and establish procedures for immediate patch deployment upon vendor release.

Altium 365 CVE-2026-9152

Q: What is the CVSS score of CVE-2026-9152?

CVE-2026-9152 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31205 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-05-21 Altium

GHSA-g63v-r3mf-m22g

Hashicorp Authentication Bypass Altium 365

10.0

CVSS 4.0 · Vendor: Altium

Severity by source

Vendor (Altium) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Unauthenticated network access with low complexity (PR:N/AC:L), cross-tenant boundary crossing warrants S:C and C:H for metadata disclosure, but integrity/availability are limited to the search index not vault data, so I:L/A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (Altium).

CVSS VectorVendor: Altium

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:32 vuln.today

CVE Published

May 21, 2026 - 00:47 cve.org

CRITICAL 10.0

CVE Published

May 21, 2026 - 00:47 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or any form of identity verification. An unauthenticated network attacker who can reference a target workspace's identifier can interact with that workspace's search index, crossing tenant boundaries.

Successful exploitation allows reading a workspace's indexed contents (such as component data, project and folder names, and user metadata) and injecting, modifying, or deleting search index entries. These operations affect the search index only, not the underlying vault data, but they can disclose sensitive workspace information and compromise the integrity and availability of search results. Altium 365 cloud deployments are affected; on-premise Altium Enterprise Server is not affected.

AnalysisAI

Missing authentication in the Altium 365 SearchService lets an unauthenticated network attacker who knows a target workspace identifier interact with that workspace's search index across tenant boundaries via a legacy SOAP endpoint. Affecting Altium 365 cloud deployments (on-premise Altium Enterprise Server is not affected), it enables reading indexed component, project, folder, and user metadata and injecting, modifying, or deleting search index entries - an authentication bypass with no public exploit identified at time of analysis, though CISA's SSVC framework marks the flaw automatable with total technical impact.

Technical ContextAI

Altium 365 is Altium's multi-tenant cloud platform for electronics/PCB design collaboration, component management, and data vaulting. The root cause is CWE-306 (Missing Authentication for a Critical Function): a legacy SOAP web-service endpoint fronting the SearchService exposes search-index operations without requiring authentication, session tokens, or identity verification. Because the endpoint accepts a workspace identifier as an untrusted parameter and performs no tenant-scoping authorization check, one caller can operate on another tenant's search index - a horizontal, cross-tenant authorization failure layered on top of the missing authentication. The affected product per NVD CPE is cpe:2.3:a:altium:altium_365 (all versions of the cloud service); the SearchService maintains a searchable index of vault artifacts (components, project/folder names, user metadata) that is distinct from the authoritative vault data store.

RemediationAI

Because Altium 365 is a vendor-hosted multi-tenant cloud service, the fix is applied server-side by Altium rather than by customers installing a package; no customer-installable fix version is published, so monitor and confirm remediation via Altium's security advisories page (https://www.altium.com/platform/security-compliance/security-advisories) and contact Altium support to verify your tenant is patched. No vendor-released patch version was identified in the available data for independent citation. As compensating controls where network reachability can be constrained, restrict or IP-allowlist access to the Altium 365 endpoints if your organization fronts them through a proxy or SSO gateway, and ask Altium to confirm the legacy SOAP SearchService endpoint has been disabled or authentication-gated - noting that disabling a legacy interface can break older Altium Designer clients that still call it. Given the search-index-only scope, also review whether any sensitive project, folder, or user metadata indexed in workspaces should be renamed or de-identified to reduce disclosure value, and rotate any credentials or identifiers that appeared in searchable metadata. On-premise Altium Enterprise Server users require no action.