CVE-2026-92468

Name of the Vulnerable Software and Affected Versions zlt2000 microservices-platform versions prior to 6.0.0

Description An authorization bypass exists in the search-center service. Authenticated attackers can read any Elasticsearch index by specifying the index name in the path variables of the 'POST /search/{indexName}' and 'GET /agg/requestStat/{indexName}/{routing}' endpoints. This allows the retrieval of sensitive user records and password hashes from arbitrary indices, such as sys user, due to a lack of proper access controls.

Recommendations Update zlt2000 microservices-platform to a version newer than 6.0.0. Restrict access to the 'POST /search/{indexName}' and 'GET /agg/requestStat/{indexName}/{routing}' endpoints to minimize the risk of exploitation.