Altium 365 Git Service lets view-only users write to repositories
A viewer on a circuit design cloud service could change project files.
Summary
A permission check in the Altium 365 Git Service did not limit repository pushes to users with the required access, so a user with view-only access could write to a project's repository. Altium fixed it on its service; on-premise Altium Enterprise Server is not affected.
Affected when
- Authenticated account with existing access to the target project
What to do
Altium fixed it in Altium 365 at the service level; customers need take no action.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen