Read the docs
TI-2026-85547 Aliases CVE-2026-123184GHSA-2fff-cjw5-9mmr

Authorization flaw in Altium 365 Git Service allows repository writes

Priority LOW 31CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

The Altium 365 Git Service has an incorrect authorization flaw (CWE-863) in the permission check for pushes to project repositories. The check passes for any user holding any level of access to a project, so the required access level is not evaluated correctly. An authenticated user with view-only access to a project can write to that project's git repository. Read access was not affected, and no exploitation is reported.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level of access to the project. As a result, an authenticated user with view-only access to a project could write to that project's git repository. Read access was evaluated correctly and was not affected, and exploitation requires an authenticated account with existing access to the target project. The issue has been remediated in Altium 365 at the service level and no customer action is required. On-premise Altium Enterprise Server is not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00273 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AltiumAltium 365all versions—No fix listedCNA
  • Altium 365 VendorAltium Affected all versions Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Altium 365. The vendor reports that the issue was remediated at the service level and that no customer action is required. On-premise Altium Enterprise Server is not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123184
  2. 2026-11-05 Alias added: GHSA-2fff-cjw5-9mmr
  3. 2026-11-05 CVSS score added · CISA ADP
  4. 2026-11-05 CISA SSVC decision points changed
  5. 2026-11-05 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2026-09862 Path Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code Execution CVSS 4.0CRITICAL 10.0
  • TI-2026-62547 Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise CVSS 4.0CRITICAL 10.0
  • TI-2026-09855 Path Traversal in Altium Enterprise Server NIS Allows Unauthenticated Arbitrary File Write and File Read CVSS 4.0CRITICAL 10.0
  • TI-2026-09854 Path Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File Write CVSS 4.0CRITICAL 9.4
  • TI-2026-09851 Path traversal in Altium Enterprise Server CVSS 4.0CRITICAL 10.0
  • TI-2026-08047 Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction CVSS 4.0CRITICAL 10.0
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences