CVE-2026-9152
Altium 365’s SearchService contains a missing authentication flaw that lets anyone who knows a workspace’s identifier read or alter its search index. The vulnerability is exploitable over the network without credentials and can expose sensitive workspace information or disrupt search results. It affects only cloud deployments of Altium 365, not on‑premise servers.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Altium 365 cloud deployments (SearchService). On‑premise Altium Enterprise Server is not affected.
Real-world impact
An attacker can read component data, project and folder names, and user metadata from a target workspace, and can inject, modify, or delete search index entries. This compromises the confidentiality and integrity of the workspace’s search information and can degrade the availability of search results.
Why this severity
The CVSS score of 10 reflects that the flaw is network‑exploitable without authentication, with high impact on confidentiality, integrity, and availability of the search index. The vector indicates no mitigations are required to exploit it, and the impact is severe because it can expose sensitive data and alter search results.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 21, 2026 · May 21, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.