CVE-2026-92467

Name of the Vulnerable Software and Affected Versions zlt2000 microservices-platform versions prior to 6.0.1

Description An unverified password change issue exists in the 'PUT /users/password' endpoint. Authenticated users can change the password of any non-administrator account by omitting the current password check. This is achieved by providing an arbitrary user id and a new password in the request body to overwrite credentials without verification.

Recommendations Update zlt2000 microservices-platform to version 6.0.1 or later. As a temporary mitigation, restrict access to the 'PUT /users/password' endpoint.