CVE-2026-92469

zlt2000 microservices-platform through version 6.0.0 has an authorization bypass (CWE-639) in the file-center module's DELETE /files/{id} endpoint, which performs no validation that the requesting user owns the targeted file. Any authenticated user can first enumerate file identifiers via GET /files and then supply arbitrary identifiers to the delete endpoint, erasing other users' files and their metadata. The attack requires only low-privilege authenticated access over the network with no user interaction, resulting in high integrity and availability impact to stored file data but no confidentiality loss or system compromise. Any deployment running the file-center module of microservices-platform 6.0.0 or earlier is affected. No public proof-of-concept, CISA KEV listing, or reports of in-the-wild exploitation are currently known.

What to do: No fixed version is stated in the available data, so check the vendor's repository for a patched release and apply it when available. As an interim mitigation, add an ownership check (or role-based restriction) on DELETE /files/{id}, limit which accounts can reach the file-center API, and review deletion logs for unauthorized removals of other users' files.