CVE-2026-92467

The PUT /users/password endpoint in zlt2000 microservices-platform fails to verify the current password before applying a change (CWE-620, unverified password change). An authenticated user can send a request containing an arbitrary target user id and a new password, and the platform overwrites that account's credentials without confirming the caller knows the existing password. This allows any low-privileged authenticated user to take over any non-administrator account; administrator accounts are not affected. All deployments running zlt2000 microservices-platform version 6.0.0 or earlier are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known.

What to do: Upgrade to a release newer than 6.0.0 once a patched version is published, or add a server-side check that the caller supplies and the platform validates the current password in PUT /users/password. In the meantime, restrict network access to the users/password endpoint and review recent password-change audit logs for changes made by unexpected callers. If tampering is suspected, force a credential rotation for affected non-administrator accounts.