Server-Side Request Forgery Vulnerability in Altium Enterprise Server

CVE-2026-92808

What is CVE-2026-92808?

A vulnerability in the UnifiedLogin service of Altium Enterprise Server allows an unauthenticated attacker to exploit server-side request forgery (SSRF). This flaw enables the attacker to send malicious outbound HTTP requests to any destination from the server, potentially accessing internal services that are otherwise protected by local authentication. One of these services exposes sensitive server configuration and credential data, which can be accessed simply by sending crafted requests. This could lead to the complete compromise of the server and its services. It’s important to note that this vulnerability does not affect Altium 365 cloud deployments, where the compromised endpoint is disabled.

References