CVE-2026-92466CWE-862broken-access-control

CVE-2026-92466

High · published September 16, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
59.6
In the wild
Unconfirmed
What it is

zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including user management, role assignment, and Elasticsearch index operations by bypassing the disabled authorization enforcement.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00908 · 59.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-16T18:17Z
References (10)
https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C04_save_or_update_user.py · [email protected]https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C06_set_role_to_user.py · [email protected]https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C10_reset_password_by_id.py · [email protected]https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C11_list_all_users.py · [email protected]https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C21_delete_es_index.py · [email protected]https://github.com/zlt2000/microservices-platform · [email protected]https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-commons/zlt-auth-client-spring-boot-starter/src/main/java/com/central/oauth2/common/properties/UrlPermissionProperties.java#L25 · [email protected]https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-commons/zlt-auth-client-spring-boot-starter/src/main/java/com/central/oauth2/common/service/impl/DefaultPermissionServiceImpl.java#L59 · [email protected]https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-gateway/sc-gateway/src/main/resources/application.yml#L122 · [email protected]https://www.vulncheck.com/advisories/microservices-platform-through-6.0.0-missing-authorization-via-disabled-url-permission-checking · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 1%
    epss
  • 16 SEP 13:16Z
    microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking
    cvelistv5