This vulnerability involves a missing authentication control in the Altium 365 SearchService's legacy SOAP endpoint. The endpoint exposes search index operations without requiring any authentication or session tokens. An unauthenticated network attacker who can reference a workspace identifier can read, inject, modify, or delete entries in that workspace's search index. While the underlying vault data remains unaffected, the search index contents—including component data, project and folder names, and user metadata—can be disclosed or tampered with. This vulnerability crosses tenant boundaries and compromises search result confidentiality, integrity, and availability. It affects Altium 365 cloud deployments but not on-premise Altium Enterprise Server. The CVSS 4.0 base score is 10.0, indicating critical severity. No patch or official remediation is currently documented.

Successful exploitation allows an unauthenticated attacker to access and manipulate the search index of any workspace in Altium 365 cloud deployments if the workspace identifier is known. This leads to disclosure of sensitive workspace information and compromises the integrity and availability of search results. The underlying vault data is not affected. The vulnerability crosses tenant boundaries, posing a significant confidentiality and integrity risk. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented by the vendor. Until a patch is available, restrict network access to the affected SOAP endpoint if possible and monitor for unauthorized access attempts. Avoid exposing workspace identifiers publicly to reduce risk.