The vulnerability stems from a legacy SOAP endpoint in Altium 365 SearchService that accepts requests without any form of authentication, session token, or identity verification. An attacker who can identify a target workspace can retrieve the workspace’s indexed contents—including component data, project and folder names, and user metadata—while also injecting, modifying, or deleting index entries. These actions compromise the confidentiality of indexed information, undermine the integrity of search results, and affect availability of search services, though the underlying vault data remains untouched.

Altium’s cloud product Altium 365 is impacted. On‑premise Altium Enterprise Server is not affected. No specific version details are supplied, so any cloud deployment of Altium 365 that still exposes the legacy SOAP SearchService is considered vulnerable.

The CVSS score of 10 classifies the flaw as critical. The EPSS score is not available, so the precise likelihood of exploitation is unknown; however, the vulnerability is actively exploitable over the network without authentication. The flaw is not listed in CISA’s KEV catalog. Attackers only need network connectivity to the SOAP endpoint and the workspace ID, making the attack surface broad and the potential impact severe.