Executive brief
The zlt2000 microservices-platform is an enterprise Java-based microservices framework that manages file uploads and storage. A flaw in the file deletion endpoint allows any authenticated user to enumerate and permanently delete files belonging to other users, causing loss of critical business documents and data without owner consent or recovery options.
Technical details
The vulnerability is an authorization bypass (BOLA - Broken Object Level Authorization) in the DELETE /files/{id} endpoint of the file-center module. The endpoint accepts a file identifier and deletes the corresponding file from both the database and object storage without validating that the requesting user owns or has permission to delete the file. An attacker can enumerate valid file identifiers by calling GET /files and then supply those identifiers to the delete endpoint to remove arbitrary files. The vulnerability requires authentication but performs no ownership checks, allowing lateral attacks across user accounts. Patches are not mentioned in the advisory.
Affected products
- zlt2000 microservices-platform through 6.0.0
Timeline
- 2026-09-16: disclosed