# CVE-2026-92467: zlt2000 microservices-platform unverified password change in PUT /users/password

Source: https://junglewise.ai/threats/cve-2026-92467-zlt2000-microservices-platform-unverified-password-change-in-put  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92467 · Severity: high · CVSS 8.3 · Published 2026-09-16

The zlt2000 microservices-platform is an enterprise microservices framework used to build multi-tenant systems with centralized user authentication. An authenticated attacker can bypass password verification checks and reset the password of any non-administrator user account, gaining complete control over those accounts without the victim's knowledge or consent.

Technologies: [Zlt2000 Microservices-Platform](https://junglewise.ai/threats/technologies/microservices-platform). Vendors: [Zlt2000](https://junglewise.ai/threats/vendors/zlt2000).

## Quick answers

**Is CVE-2026-92467 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92467 being exploited in the wild.

**How severe is CVE-2026-92467?** High severity, with a CVSS score of 8.3, published 16 September 2026.

**Which products and versions are affected?** Zlt2000 Microservices-Platform through 6.0.0.

**Is there a fix for CVE-2026-92467?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92467 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-92467?** Check whether you run Zlt2000 Microservices-Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in the PUT /users/password endpoint caused by insufficient validation of password reset requests. The service controller accepts an arbitrary user ID from the request body and only checks that the target is not the admin account (id != 1), but fails to verify that the requester is the account owner or an administrator. Additionally, the password validation logic only performs old password verification if the old password field is non-empty, allowing attackers to omit it entirely to bypass the check. An authenticated user can supply any non-admin user ID and a new password to overwrite the target account's credentials. A proof-of-concept exploit has been publicly released on GitHub demonstrating account takeover (ATO) of victim accounts.

## Affected products

- zlt2000 microservices-platform through 6.0.0

## Timeline

- 2026-09-16: disclosed: CVE-2026-92467 published on NVD
- 2026-09-16: exploited: Public proof-of-concept exploit released on GitHub

## References

- [https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C09_reset_any_user_password.py](https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C09_reset_any_user_password.py)
- [https://github.com/zlt2000/microservices-platform](https://github.com/zlt2000/microservices-platform)

## Related threats

- [zlt2000 microservices-platform authorization bypass in file-center DELETE](https://junglewise.ai/threats/cve-2026-92469-zlt2000-microservices-platform-authorization-bypass-in-file)
- [zlt2000 microservices-platform authorization bypass in search-center](https://junglewise.ai/threats/cve-2026-92468-zlt2000-microservices-platform-authorization-bypass-in-search)
- [zlt2000 microservices-platform authorization bypass in URL permission enforcement](https://junglewise.ai/threats/cve-2026-92466-zlt2000-microservices-platform-authorization-bypass-in-url)