{"id":"CVE-2026-92466","published":"2026-09-16T14:17:17.313","lastModified":"2026-09-16T19:47:01.197","description":"zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including user management, role assignment, and Elasticsearch index operations by bypassing the disabled authorization enforcement.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C04_save_or_update_user.py","tags":[]},{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C06_set_role_to_user.py","tags":[]},{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C10_reset_password_by_id.py","tags":[]},{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C11_list_all_users.py","tags":[]},{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C21_delete_es_index.py","tags":[]},{"url":"https://github.com/zlt2000/microservices-platform","tags":[]},{"url":"https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-commons/zlt-auth-client-spring-boot-starter/src/main/java/com/central/oauth2/common/properties/UrlPermissionProperties.java#L25","tags":[]},{"url":"https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-commons/zlt-auth-client-spring-boot-starter/src/main/java/com/central/oauth2/common/service/impl/DefaultPermissionServiceImpl.java#L59","tags":[]},{"url":"https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-gateway/sc-gateway/src/main/resources/application.yml#L122","tags":[]},{"url":"https://www.vulncheck.com/advisories/microservices-platform-through-6.0.0-missing-authorization-via-disabled-url-permission-checking","tags":[]}],"exploitRefs":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C04_save_or_update_user.py","tags":[]},{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C06_set_role_to_user.py","tags":[]},{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C10_reset_password_by_id.py","tags":[]},{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C11_list_all_users.py","tags":[]},{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C21_delete_es_index.py","tags":[]},{"url":"https://github.com/zlt2000/microservices-platform","tags":[]},{"url":"https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-commons/zlt-auth-client-spring-boot-starter/src/main/java/com/central/oauth2/common/properties/UrlPermissionProperties.java#L25","tags":[]},{"url":"https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-commons/zlt-auth-client-spring-boot-starter/src/main/java/com/central/oauth2/common/service/impl/DefaultPermissionServiceImpl.java#L59","tags":[]},{"url":"https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-gateway/sc-gateway/src/main/resources/application.yml#L122","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows authenticated users without roles to access administrative APIs, leading to unauthorized access and potential data manipulation.","exploitability":"Exploitation is relatively easy given that the vulnerability is enabled by default and no roles are required for access.","blast_radius":"If exploited, this could result in unauthorized changes to user management, role assignments, and Elasticsearch configurations, leading to significant data and operational risks.","remediation":"Upgrade to zlt2000 microservices-platform 6.1.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","api","admin","microservices"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-30T09:11:27.079Z"}}