Missing Authorization Vulnerability in zlt2000 Microservices Platform
CVE-2026-92466

8.7HIGH

Key Information:

Vendor: Zlt2000
Status: Microservices-platform
Vendor: CVE Published:; 16 September 2026

🔔 Create Zlt2000 Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-92466?

The zlt2000 Microservices Platform through version 6.0.0 is affected by a vulnerability where the permission control mechanism is misconfigured. The 'urlPermission.enable' flag is set to false by default, which effectively disables authorization checks after user authentication. This flaw allows authenticated users—regardless of their assigned roles—to access sensitive administrative APIs. Such access can lead to unauthorized actions like managing users, assigning roles, and manipulating Elasticsearch indices, posing significant security risks.

Affected Version(s)

microservices-platform 0 <= 6.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-92466 - Proof of Concept