CVE-2026-92469

Name of the Vulnerable Software and Affected Versions zlt2000 microservices-platform versions prior to 6.0.0

Description An authorization bypass exists in the file-center module. The 'DELETE /files/{id}' endpoint fails to perform ownership validation, allowing authenticated attackers to delete files and metadata belonging to other users. Attackers can identify target files by enumerating identifiers through the 'GET /files' endpoint and then providing the id variable to the delete endpoint.

Recommendations Update zlt2000 microservices-platform to version 6.0.0 or later. Restrict access to the 'DELETE /files/{id}' endpoint to prevent unauthorized file deletion.