Description

An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level of access to the project. As a result, an authenticated user with view-only access to a project could write to that project's git repository. Read access was evaluated correctly and was not affected, and exploitation requires an authenticated account with existing access to the target project. The issue has been remediated in Altium 365 at the service level and no customer action is required. On-premise Altium Enterprise Server is not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-11-05T18:17:08.000Z",
  "pubdate": "2026-11-05T18:17:08.000Z",
  "executiveSummary": "An incorrect authorization vulnerability was identified within the Altium 365 Git Service, involving a flaw in the permission validation logic for repository write operations.\nThe vulnerability allowed authenticated users possessing only 'view-only' project access to successfully perform git push operations to protected project repositories.\nThis represents an Improper Authorization (CWE-285) issue where the system failed to correctly enforce role-based access control (RBAC) during service requests.\nThe scope of the impact is confined to the Altium 365 cloud service environment; the on-premise Altium Enterprise Server is not affected.\nExploitation requires the attacker to be an authenticated user already granted at least view-level permissions to the specific target project.\nNo customer-side remediation is required as the vendor has addressed the flaw at the service level, effectively neutralizing the authorization bypass.",
  "technicalDetails": "The root cause of the vulnerability resides in the authorization middleware of the Altium 365 Git Service. When a client initiates a git push request, the service is designed to perform a permission evaluation to verify if the user possesses the 'Write' or 'Maintainer' access levels necessary to modify the repository state.\nDuring the flawed execution, the access control check failed to properly differentiate between the 'View-Only' and 'Write' access privileges. The logic incorrectly evaluated the presence of any valid user project relationship as sufficient authorization, bypassing the specific granular requirement for write-level access.\nThe attack flow proceeds as follows: 1) An authenticated user with existing 'View-Only' project access identifies a target repository within the Altium 365 ecosystem. 2) The user initiates a git push command using standard git protocols. 3) The backend Git Service triggers an authorization check. 4) The service fails to validate the required write privilege level, instead confirming only that the user has some form of existing access to the project. 5) The repository permits the push, effectively allowing the user to modify project files, introduce unauthorized code, or overwrite existing commits.\nThis vulnerability is limited to the repository write path; read access evaluations remain logically sound and are not impacted by this flaw. The attack surface is restricted to authenticated users, meaning that anonymous or unauthenticated actors cannot exploit this issue. Successful exploitation grants the attacker the ability to alter repository integrity, which could be leveraged to disrupt development pipelines or gain unauthorized control over project assets.\nThe vulnerability was remediated at the Altium 365 service level by correcting the authorization logic to strictly enforce the requirement of sufficient project-level write permissions before finalizing a commit or push transaction."
}