CVE-2026-9152: Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction
A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or any form of identity verification. An unauthenticated network attacker who can reference a target workspace's identifier can interact with that workspace's search index, crossing tenant boundaries.
Successful exploitation allows reading a workspace's indexed contents (such as component data, project and folder names, and user metadata) and injecting, modifying, or deleting search index entries. These operations affect the search index only, not the underlying vault data, but they can disclose sensitive workspace information and compromise the integrity and availability of search results. Altium 365 cloud deployments are affected; on-premise Altium Enterprise Server is not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Altium 365 SearchService legacy SOAP endpointfrom your environment.Disable or remove the legacy SOAP endpoint that exposes search index operations to eliminate the unauthenticated access vector.
- Configuration
Require authentication/session tokens or other identity verification for the legacy SOAP search endpoint so that unauthenticated requests cannot access or modify workspace search indexes.
Altium 365 SearchService (legacy SOAP endpoint) authentication_required = true - Compensating control
Restrict network access to the legacy SOAP endpoint using firewall rules, ACLs, or a WAF so only trusted management IPs or internal networks can reach it until the endpoint is secured or removed.
- Operational
Audit search index activity for unauthorized read, create, modify, or delete operations; rebuild or restore affected search indexes from known-good backups if tampering is detected and notify affected workspace owners.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9152?
CVE-2026-9152 is considered a critical vulnerability due to its potential for unrestricted access and data exfiltration.
How do I fix CVE-2026-9152?
To fix CVE-2026-9152, implement authentication for the SOAP endpoint in Altium 365 SearchService to prevent unauthorized access.
What type of attacks can be performed with CVE-2026-9152?
CVE-2026-9152 allows for cross-tenant data exfiltration and destruction of search indices due to lack of authentication.
Who is affected by CVE-2026-9152?
CVE-2026-9152 affects all users of Altium 365 SearchService that utilize the vulnerable SOAP endpoint without proper authentication.
Is there a workaround for CVE-2026-9152?
Currently, the recommended workaround for CVE-2026-9152 is to disable the vulnerable SOAP endpoint until proper authentication mechanisms are implemented.