---
id: CVE-2026-92466
title: >-
  zlt2000 microservices-platform through 6.0.0 contains a missing authorization
  vulnerability where the zlt.security.auth.urlPermission.enable flag defaults
  to false, disabling all permission checks after authentication
summary: >-
  zlt2000 microservices-platform through 6.0.0 contains a missing authorization
  vulnerability where the zlt.security.auth.urlPermission.enable flag defaults
  to false, disabling all permission checks after authentication. Authenticated
  user…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-862
vendor: zlt2000
product: microservices-platform
affected:
  - microservices-platform <= 6.0.0
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T19:47:01.197'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92466'
references:
  - url: >-
      https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C04_save_or_update_user.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C06_set_role_to_user.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C10_reset_password_by_id.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C11_list_all_users.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C21_delete_es_index.py
    label: disclosure@vulncheck.com
  - url: 'https://github.com/zlt2000/microservices-platform'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-commons/zlt-auth-client-spring-boot-starter/src/main/java/com/central/oauth2/common/properties/UrlPermissionProperties.java#L25
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-commons/zlt-auth-client-spring-boot-starter/src/main/java/com/central/oauth2/common/service/impl/DefaultPermissionServiceImpl.java#L59
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-gateway/sc-gateway/src/main/resources/application.yml#L122
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/microservices-platform-through-6.0.0-missing-authorization-via-disabled-url-permission-checking
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-16T13:35:43.719602Z'
ingestedAt: '2026-09-16T13:56:12.616Z'
epss: 0.00908
epssPercentile: 0.58325
---

## Overview

zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including user management, role assignment, and Elasticsearch index operations by bypassing the disabled authorization enforcement.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.