PT-2026-42360 · Altium · Altium 365

Joris Aerts · CVE-2026-9152 · Published 2026-05-21 · Updated 2026-05-21

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Altium 365 (affected versions not specified)

Description A missing authentication issue exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or identity verification. An unauthenticated network attacker with a target workspace identifier can interact with the search index, crossing tenant boundaries. This allows the attacker to read indexed contents, such as component data, project and folder names, and user metadata, as well as inject, modify, or delete search index entries. These actions impact the search index rather than the underlying vault data, potentially disclosing sensitive workspace information and compromising the integrity and availability of search results.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

IDOR

Weakness Enumeration

CWE-306

CWE-639

Related Identifiers

CVE-2026-9152

Affected Products

Altium 365

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-9152 · Security Note
• https://t.me/cveNotify/164326 · Telegram Post
• https://t.me/CVEtracker/54454 · Telegram Post
• https://twitter.com/CVEnew/status/2057407796505698624 · Twitter Post
• https://altium.com/platform/security-compliance/security-advisories · Note
• https://twitter.com/infoflowcloud/status/2057408786365599795 · Twitter Post