Executive brief
zlt2000 microservices-platform is a Java-based microservices framework used to build scalable backend systems. A configuration flaw causes the authorization permission enforcement to be disabled by default, allowing any authenticated user—regardless of assigned roles—to access sensitive administrative APIs including user management, role assignment, and Elasticsearch operations. An attacker with any valid login can escalate their privileges or modify other users without any access controls.
Technical details
The vulnerability is a missing authorization check caused by the zlt.security.auth.urlPermission.enable configuration flag defaulting to false, which disables all permission checks after authentication. Although the application performs user authentication via OAuth, it fails to enforce role-based access control on protected endpoints. Authenticated users with no assigned roles can call administrative APIs such as POST /users/saveOrUpdate (to create or modify users and bind roles), POST /users/{id}/roles (to assign roles to any user), and Elasticsearch index operations. The vulnerable components are in the SysUserController and related service layer, which lack checkAdmin() and role validation calls. The impact is vertical privilege escalation: a low-privilege user can grant themselves admin roles or modify other users' attributes. No patch status is publicly confirmed; users should upgrade beyond version 6.0.0 and immediately enable the urlPermission.enable flag if available.
Affected products
- zlt2000 microservices-platform through 6.0.0
Timeline
- 2026-09-16: disclosed
- other: CVE-2026-92466 assigned