Altium 365's workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing policy that allows credentialed requests from any Altium‑controlled subdomain, such as forum.live.altium.com. This misconfiguration permits JavaScript running on those origins to call authenticated workspace APIs on behalf of a logged‑in user. The vulnerability is a classic access control flaw (CWE‑284) combined with a CORS misconfiguration (CWE‑942).

The affected product is Altium 365, including deployments in standard and GovCloud environments. No specific product version numbers are listed; the issue applies to any instance exposing the described workspace endpoints. Subdomains controlled by Altium, like forum.live.altium.com, are implicitly included in the attack surface.

The CVSS score of 9 indicates high severity, while the EPSS score of less than 1% suggests a low probability of public exploitation at the time of assessment. The vulnerability is not listed in CISA's KEV catalog, implying no current evidence of widespread exploitation. The likely attack vector is cross‑origin JavaScript injection via an allowed subdomain, often chained with existing vulnerabilities in those external applications to read or modify workspace data, perform administrative actions, and sidestep IP allowlisting controls.