CVE-2026-92466

zlt2000 microservices-platform through 6.0.0 ships with the zlt.security.auth.urlPermission.enable flag set to false by default, which disables all URL-level permission enforcement after a user authenticates. Any authenticated account, even one with no roles assigned, can therefore call administrative APIs directly, including user management, role assignment, and Elasticsearch index operations. This lets a low-privileged or newly registered user escalate privileges (e.g., grant themselves roles), manage accounts, and manipulate Elasticsearch data. All deployments running version 6.0.0 or earlier that have not explicitly enabled the URL permission check are affected. There is currently no public proof-of-concept, no CISA KEV listing, and no known exploitation in the wild.

What to do: Explicitly set zlt.security.auth.urlPermission.enable=true in all deployments instead of relying on the insecure default, and verify that administrative endpoints (user management, role assignment, Elasticsearch index operations) reject accounts without roles. Upgrade to a patched release when one becomes available, audit role assignments and recently created accounts for signs of abuse, and review application logs for admin API calls from role-less users.