Vulnerability Description
zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including user management, role assignment, and Elasticsearch index operations by bypassing the disabled authorization enforcement.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/
- https://github.com/zlt2000/microservices-platform
- https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-commons/zlt-au
- https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-commons/zlt-au
- https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-gateway/sc-gat
- https://www.vulncheck.com/advisories/microservices-platform-through-6.0.0-missin
FAQ
What is CVE-2026-92466?
CVE-2026-92466 is a vulnerability with a CVSS score of 8.8 (HIGH). zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks aft...
How severe is CVE-2026-92466?
CVE-2026-92466 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92466?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.