BaseFortify

Publication date: 2026-09-16

Last updated on: 2026-09-18

Assigner: VulnCheck

Description

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/{indexName} and GET /agg/requestStat/{indexName}/{routing} path variables. Attackers can query arbitrary indices including sys_user to retrieve sensitive user records and password hashes without proper access controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-16

Last Modified

2026-09-18

Generated

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-92468

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions have not been generated yet.

Hi! I’m here to help you understand CVE-2026-92468. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70