CVE-2026-92466

microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking

HIGH 8.7EPSS 0.9%

zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including user management, role assignment, and Elasticsearch index operations by bypassing the disabled authorization enforcement.

Affected: zlt2000 · microservices-platform
CVSS v4.0 VULNCHECK: 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 VULNCHECK: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.91% chance of exploitation in the next 30 days, 59th percentile
Published: 2026-09-16

Proof-of-concept exploits (1)

LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C11_list_all_users.py1★ · 2026-09-19

CVE-2026-92466

Proof-of-concept exploits (1)

References