microservices-platform vulnerabilities

3 known vulnerabilities in microservices-platform from Zlt2000. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  microservices-platform: Authorization Bypass Through User-Controlled Key

  CVE-2026-92469Sep 16, 2026Zlt2000

  zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/{id} endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and d

• 8.3 High severity

  microservices-platform: Unverified Password Change

  CVE-2026-92467Sep 16, 2026Zlt2000

  zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an

• 8.8 High severity

  microservices-platform: Missing Authorization

  CVE-2026-92466Sep 16, 2026Zlt2000

  zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can acc