CVE-2026-1181

CRITICAL 9.0CVE-2026-1181 · Published 19/01/2026 · updated 17/06/2026

In short

CVE-2026-1181 is a CRITICAL (CVSS 9.0) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.35%, higher than 28.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.

References

altium.com/platform/security-compliance/security-advisories

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free