# CVE-2026-92466: zlt2000 microservices-platform authorization bypass in URL permission enforcement

Source: https://junglewise.ai/threats/cve-2026-92466-zlt2000-microservices-platform-authorization-bypass-in-url  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92466 · Severity: high · CVSS 8.8 · Published 2026-09-16

zlt2000 microservices-platform is a Java-based microservices framework used to build scalable backend systems. A configuration flaw causes the authorization permission enforcement to be disabled by default, allowing any authenticated user—regardless of assigned roles—to access sensitive administrative APIs including user management, role assignment, and Elasticsearch operations. An attacker with any valid login can escalate their privileges or modify other users without any access controls.

Technologies: [Zlt2000 Microservices-Platform](https://junglewise.ai/threats/technologies/microservices-platform). Vendors: [Zlt2000](https://junglewise.ai/threats/vendors/zlt2000).

## Quick answers

**Is CVE-2026-92466 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92466 being exploited in the wild.

**How severe is CVE-2026-92466?** High severity, with a CVSS score of 8.8, published 16 September 2026.

**Which products and versions are affected?** Zlt2000 Microservices-Platform through 6.0.0.

**Is there a fix for CVE-2026-92466?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92466 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92466?** Check whether you run Zlt2000 Microservices-Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check caused by the zlt.security.auth.urlPermission.enable configuration flag defaulting to false, which disables all permission checks after authentication. Although the application performs user authentication via OAuth, it fails to enforce role-based access control on protected endpoints. Authenticated users with no assigned roles can call administrative APIs such as POST /users/saveOrUpdate (to create or modify users and bind roles), POST /users/{id}/roles (to assign roles to any user), and Elasticsearch index operations. The vulnerable components are in the SysUserController and related service layer, which lack checkAdmin() and role validation calls. The impact is vertical privilege escalation: a low-privilege user can grant themselves admin roles or modify other users' attributes. No patch status is publicly confirmed; users should upgrade beyond version 6.0.0 and immediately enable the urlPermission.enable flag if available.

## Affected products

- zlt2000 microservices-platform through 6.0.0

## Timeline

- 2026-09-16: disclosed
- other: CVE-2026-92466 assigned

## References

- [https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C04_save_or_update_user.py](https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C04_save_or_update_user.py)
- [https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C06_set_role_to_user.py](https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C06_set_role_to_user.py)

## Related threats

- [zlt2000 microservices-platform authorization bypass in file-center DELETE](https://junglewise.ai/threats/cve-2026-92469-zlt2000-microservices-platform-authorization-bypass-in-file)
- [zlt2000 microservices-platform authorization bypass in search-center](https://junglewise.ai/threats/cve-2026-92468-zlt2000-microservices-platform-authorization-bypass-in-search)
- [zlt2000 microservices-platform unverified password change in PUT /users/password](https://junglewise.ai/threats/cve-2026-92467-zlt2000-microservices-platform-unverified-password-change-in-put)