CVE-2026-92468

zlt2000 microservices-platform through version 6.0.0 contains an authorization bypass (CWE-639) in its search-center service. An authenticated attacker can supply an arbitrary Elasticsearch index name as a path variable in POST /search/{indexName} or GET /agg/requestStat/{indexName}/{routing}, and the service queries that index without verifying the caller is authorized to access it. This allows any low-privileged authenticated user to read data from any Elasticsearch index in the cluster, including the sys_user index, exposing user records and password hashes. All deployments of microservices-platform up to and including 6.0.0 are affected. There are currently no known public proofs of concept, no reports of exploitation in the wild, and the issue is not listed in CISA's KEV catalog.

What to do: No fixed version is specified in the disclosure, so check the vendor's GitHub repository for a patched release and upgrade beyond 6.0.0 when available. In the meantime, restrict access to the /search/{indexName} and /agg/requestStat/ endpoints at the gateway or via WAF rules, and enforce an allowlist of index names each authenticated role may query. Because the sys_user index with password hashes is readable through this flaw, audit access logs for unexpected index queries and consider rotating user credentials on exposed deployments.