CVSS 4.0
8.7 highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2026-92466
High (8.7). EPSS 0.9% chance of exploitation in the next 30 days.
zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including user management, role assignment, and Elasticsearch index operations by bypassing the disabled authorization enforcement.
Severity
CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
References
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C04_save_or_update_user.py
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C06_set_role_to_user.py
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C10_reset_password_by_id.py
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C11_list_all_users.py
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C21_delete_es_index.py