CVE-2026-92808
CriticalCVSS 10.0Summary
A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can cause the server to issue outbound HTTP requests to a destination of the attacker's choosing, including internal services reachable only from the server. One such internal service exposes configuration and credential material without authentication, relying on local origin, which is satisfied by forged requests.
Risk Assessment
An attacker can retrieve stored credentials and use them to obtain an administrative session, resulting in full compromise of the server and all its services. Altium 365 cloud deployments are not affected as the endpoint is disabled in cloud mode.
Recommendation
Apply vendor patches for Altium Enterprise Server. Restrict network access to the server and monitor outbound HTTP requests for suspicious patterns.
Other vulnerabilities in Altium Enterprise Server
See all- CVE-2026-11429Critical
Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename is used to construct the destination path without validation, allowing arbitrary file writes. The write occurs before authentication, so no credentials are needed.
- CVE-2026-11423Critical
Path traversal vulnerability in Altium Enterprise Server Collaboration Service allows an authenticated user to read arbitrary files from the server filesystem via a crafted filename in a collaboration message. This can lead to exposure of configuration with passwords and full server compromise.
- CVE-2026-11420Critical
Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to writable locations and read package archive files. No authentication is required.
- CVE-2026-11414Critical
Altium Enterprise Server has a vulnerability related to the use of a hard-coded cryptographic key for signing file download URLs. This key is identical across all installations, allowing unauthenticated attackers to forge signatures and retrieve files from the Vault storage area without authentication.
- CVE-2026-9129Critical
Altium Enterprise Server Viewer has a path traversal vulnerability in the StorageController component. An authenticated user can read arbitrary files from the server filesystem, including the configuration file with database credentials and signing keys.
- CVE-2026-9102Critical
Altium Enterprise Server ComparisonService has a path traversal vulnerability in the Gerber file upload APIs. An authenticated workspace user can supply a crafted filename in the Content-Disposition header to write files outside the intended temporary directory, potentially leading to remote code execution.
- CVE-2026-11431High
A path traversal vulnerability in the Projects Service download endpoint of Altium Enterprise Server and Altium 365 allows an authenticated user to read arbitrary files (including entire directories as archives) from the server filesystem, potentially exposing configuration and credential data.
- CVE-2026-11424High
SSRF vulnerability in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated user can submit a request that the server treats as a URL and issues an outbound HTTP GET without validation, returning the response to the attacker.
- CVE-2026-11419High
A path traversal vulnerability in Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the configured storage root is discarded, allowing arbitrary files to be written to any location on the server filesystem writable by the service account. This can be escalated to remote code execution, service takeover, or denial of service. Altium 365 cloud deployments are not affected.
Original NVD description (English source)
A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can cause the server to issue outbound HTTP requests to a destination of the attacker's choosing, including internal services that are reachable only from the server itself. One such internal service exposes server configuration and credential material without authentication, relying only on the request originating locally. Because the forged requests originate from the server process, that check is satisfied. An unauthenticated attacker can therefore retrieve stored credentials and use them to obtain an administrative session, resulting in full compromise of the server and all of its services. Altium 365 cloud deployments are not affected, as the affected endpoint is disabled in cloud mode.