Authorization Bypass in zlt2000 microservices-platform

The zlt2000 microservices-platform, version 6.0.0 and earlier, contains a critical security configuration vulnerability (CVE-2026-92466). The platform defaults the 'zlt.security.auth.urlPermission.enable' configuration flag to 'false'. When this flag is disabled, the platform fails to enforce URL-level permission checks for authenticated sessions. This flaw essentially renders the role-based access control (RBAC) mechanism ineffective, allowing any successfully authenticated user - regardless of their assigned roles or privileges - to interact with sensitive administrative endpoints. This exposure permits unauthorized users to perform administrative tasks, including managing user accounts, modifying role assignments, and interacting directly with Elasticsearch index operations, posing a significant risk of privilege escalation and unauthorized data manipulation within the microservices environment.

Impact

The vulnerability allows for complete unauthorized administrative access to the platform's backend services. An attacker who gains low-privileged credentials can escalate privileges to perform administrative actions, potentially leading to full system compromise, exfiltration of data via Elasticsearch index access, and the modification of user accounts to maintain persistent, high-privileged access.

Recommendation

Prioritized actions for security and IT teams:

• Apply the configuration update by setting 'zlt.security.auth.urlPermission.enable' to 'true' in the platform's configuration file immediately.
• Audit administrative audit logs to identify any unexpected access to sensitive API endpoints such as '/api/user/manage' or Elasticsearch management interfaces initiated by low-privileged user accounts.
• Review all user accounts and role assignments for unauthorized modifications performed during the period the platform was running with the default configuration.