CVE-2026-9152

The vulnerability results from the presence of an unprotected legacy SOAP endpoint that does not require authentication, session tokens, or any other form of identity verification (CWE-306). An attacker who knows or guesses the target workspace identifier can directly invoke operations on that workspace's search index — regardless of which tenant it belongs to (CWE-639: improper control of object reference based access control). These operations include reading, injecting, modifying, and deleting entries in the search index.

An attacker can disclose sensitive workspace data stored in the index (such as component data, project and folder names, and user metadata), and compromise the integrity and availability of search results by injecting, modifying, or deleting index entries. These operations do not directly affect data in the vault; however, they can seriously disrupt the operation of the design environment.

Apply patches available from the vendor according to the references — details in the Altium security advisory available at https://www.altium.com/platform/security-compliance/security-advisories. Since the vulnerability affects only the Altium 365 cloud environment, the patch should be deployed on the service provider's side.

Altium 365 cloud deployments — does not affect on-premise installations (Altium Enterprise Server).