CVE-2026-9152: Altium 365 Auth Bypass Vulnerability

CVE-2026-9152 Overview

CVE-2026-9152 is a missing authentication vulnerability [CWE-306] in the Altium 365 SearchService. A legacy Simple Object Access Protocol (SOAP) endpoint exposes search index operations without requiring authentication, session tokens, or any identity verification. An unauthenticated network attacker who can reference a target workspace identifier can interact with that workspace's search index, crossing tenant boundaries. Successful exploitation allows reading indexed contents and injecting, modifying, or deleting search index entries. Altium 365 cloud deployments are affected; on-premise Altium Enterprise Server is not affected.

Critical Impact

Unauthenticated attackers can cross tenant boundaries to read, modify, or delete any workspace's search index data, exposing component, project, folder, and user metadata.

Affected Products

• Altium 365 (cloud deployments)
• Altium 365 SearchService legacy SOAP endpoint
• Altium Enterprise Server (on-premise) — Not affected

Discovery Timeline

• 2026-05-21 - CVE CVE-2026-9152 published to NVD
• 2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-9152

Vulnerability Analysis

The SearchService component in Altium 365 exposes a legacy SOAP endpoint that performs no authentication checks before processing requests. The endpoint accepts a workspace identifier as a request parameter and routes operations against that workspace's search index. Because the service does not validate session tokens, API keys, or any other credential, any network-reachable client can issue requests. The flaw maps to CWE-306, Missing Authentication for Critical Function.

Exploitation affects three data security properties simultaneously. Attackers can read indexed contents such as component data, project and folder names, and user metadata. They can inject new entries, modify existing entries, or delete entries from the index. The underlying vault data is not directly modified, but search results become unreliable and confidential workspace metadata is exposed across tenant boundaries.

Root Cause

The root cause is the absence of authentication and authorization logic on the legacy SOAP endpoint. The service treats workspace identifiers as both a routing parameter and an implicit access grant. No tenant isolation is enforced at the request handler, allowing cross-tenant operations whenever an attacker knows or guesses a workspace identifier.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker constructs a SOAP request targeting the SearchService endpoint, supplies a victim workspace identifier, and invokes index read or write operations. See the Altium Security Advisories for the vendor's technical details. No verified public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-9152

Indicators of Compromise

• Unexpected SOAP requests to the Altium 365 SearchService endpoint originating from unknown source addresses.
• Search index entries that reference workspace identifiers not associated with the requesting tenant.
• Unexplained additions, deletions, or modifications of search index records affecting component, project, or folder metadata.
• Search results returning content that does not match underlying vault data, indicating index tampering.

Detection Strategies

• Inspect application and proxy logs for SOAP calls to SearchService that lack accompanying authentication headers or session context.
• Correlate workspace identifier values across requests to identify clients touching multiple unrelated tenants.
• Baseline normal SearchService request volumes per tenant and alert on statistical anomalies.

Monitoring Recommendations

• Forward Altium 365 access logs to a centralized logging or SIEM platform for retention and correlation.
• Monitor for sudden spikes in search index write operations or bulk read patterns targeting metadata fields.
• Track outbound network connections from cloud-hosted application tiers to detect lateral reconnaissance following any index disclosure.

How to Mitigate CVE-2026-9152

Immediate Actions Required

• Confirm whether your organization uses Altium 365 cloud workspaces; on-premise Altium Enterprise Server deployments are not affected.
• Review the Altium Security Advisories page for the current remediation status and any tenant-side actions.
• Audit recent search index activity within affected workspaces for unauthorized reads, modifications, or deletions.
• Rotate any credentials or shared secrets whose names or metadata may have been exposed through workspace indexes.

Patch Information

Altium 365 is a vendor-managed cloud service. Remediation is delivered server-side by Altium. Refer to the Altium Security Advisories page for confirmation of the fix rollout and any required customer action.

Workarounds

• No customer-side workaround is available for the legacy SOAP endpoint because the service is hosted by Altium.
• Restrict and monitor which users in your organization have access to sensitive component libraries and project metadata that may have been indexed.
• Treat workspace identifiers as sensitive values and avoid sharing them outside trusted channels until the vendor confirms remediation.

# Configuration example
# No customer-configurable mitigation is available for this cloud-hosted service.
# Consult the vendor advisory for remediation status:
# https://www.altium.com/platform/security-compliance/security-advisories