CVE-2026-92467: ZLT2000 Microservices-Platform

High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days.

zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request body and a new password to overwrite credentials of any non-administrator account without verification.

Affected products

• ZLT2000 Microservices-Platform: up to and including 6.0.0

Published 2026-09-16. Last modified 2026-09-21.