CVE-2026-1181

Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.

• CWE-284
• CWE-942

• https://www.altium.com/platform/security-compliance/security-advisories

Published

Jan 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118091Missing Authorization vulnerability in WPFunnels Team WPFunn…5.3
• CVE-2026-118092Missing Authorization vulnerability in StylemixThemes Master…4.3
• CVE-2026-118093Missing Authorization vulnerability in WPFunnels Team Produc…5.3
• CVE-2026-118094Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-118095Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-118097Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-11810The UpdateHub firmware-update agent's probe handler (z_impl_…7.5
• CVE-2026-118100The BuddyForms WordPress plugin before 2.10.3 does not check…5.3
• CVE-2026-118101The BuddyForms WordPress plugin before 2.10.1 does not verif…5.3
• CVE-2026-118102Use of a broken or risky cryptographic algorithm in SQL Serv…5.9
• CVE-2026-118103Out-of-bounds read in SQL Server allows an unauthorized atta…6.5
• CVE-2026-118104Use of uninitialized resource in SQL Server allows an author…6.5