CVE-2026-92467: Microservices Platform Auth Bypass Flaw

CVE-2026-92467 Overview

CVE-2026-92467 affects the zlt2000/microservices-platform project through version 6.0.0. The flaw resides in the PUT /users/password endpoint, which fails to verify the requester's current password before applying a change. Authenticated users can submit an arbitrary user identifier and a new password in the request body to overwrite credentials of any non-administrator account. The weakness is classified under CWE-620: Unverified Password Change and enables horizontal account takeover across the platform's user base.

Critical Impact
Any authenticated low-privilege user can hijack other non-administrator accounts by resetting their passwords without knowing the original credentials.

Affected Products

zlt2000/microservices-platform versions up to and including 6.0.0
Deployments exposing the user-center service PUT /users/password endpoint
Downstream applications embedding the vulnerable SysUserController and SysUserServiceImpl components

Discovery Timeline

2026-09-16 - CVE-2026-92467 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92467

Vulnerability Analysis

The vulnerability is a broken access control and business logic flaw in the password reset workflow. The controller at SysUserController.java line 206 accepts a JSON body containing a target id and a new password. The service layer at SysUserServiceImpl.java line 165 then encodes and persists the supplied password against the specified user identifier.

No check confirms that the caller owns the target account, and no verification of the existing password is performed. A malicious authenticated user can therefore change credentials for any non-administrator account by iterating user IDs. Successful exploitation yields full account takeover of victim accounts, enabling data access, impersonation, and lateral movement inside applications built on the platform.

Root Cause

The root cause is the absence of two required controls in the password change handler: verification of the current password and enforcement that the authenticated principal matches the target id. The service treats the request body as authoritative and trusts the client-supplied user identifier without an authorization check against the session subject.

Attack Vector

Exploitation requires network access to the exposed HTTP endpoint and valid low-privilege credentials. The attacker issues a PUT /users/password request supplying the victim's numeric id and a chosen new password. The server accepts the change and overwrites the stored credential hash. Administrator accounts are excluded by an existing role check, but every other account remains reachable. A public proof-of-concept script demonstrating the request flow is available in the CVE request PoC repository.

The vulnerability manifests as a missing authorization branch in the request handler. See the VulnCheck advisory and the linked source lines for technical details.

Detection Methods for CVE-2026-92467

Indicators of Compromise

PUT /users/password requests where the JSON body id does not match the authenticated user's own identifier
Password change events for multiple distinct user IDs originating from a single session or source IP within a short window
Successful authentications immediately followed by account-owner complaints of lockout or unexpected credential changes

Detection Strategies

Enable verbose request logging on the user-center service and correlate the request id field with the authenticated principal in the JWT or session context
Alert on any PUT /users/password call issued by a non-administrator account where the target id differs from the caller's id
Baseline normal password-change frequency per user and flag deviations, particularly bursts of consecutive resets

Monitoring Recommendations

Ingest reverse proxy and application logs into a centralized analytics platform and retain full request bodies for the affected endpoint
Monitor authentication logs for post-reset logins from new IP addresses or user agents on recently modified accounts
Track failed logins on victim accounts that suddenly succeed with a new credential, indicating potential takeover

How to Mitigate CVE-2026-92467

Immediate Actions Required

Restrict network exposure of the PUT /users/password endpoint at the API gateway to internal traffic only until a patch is applied
Force password resets and revoke active sessions for all non-administrator accounts after auditing recent password change activity
Add a server-side authorization filter that rejects any request where the body id differs from the authenticated user's id

Patch Information

No official vendor patch is referenced in the advisory at the time of publication. Operators should track the zlt2000/microservices-platform repository for a fix beyond version 6.0.0 and apply source-level mitigations in the interim.

Workarounds

Modify SysUserController to require and validate the current password parameter before invoking the update service method
Enforce that the id field in the request body equals the authenticated user's identifier, or require administrator role for cross-account resets
Introduce rate limiting and audit logging on the password change endpoint to slow and detect abuse

bash

# Example API gateway rule (nginx) restricting the endpoint to internal networks
location = /users/password {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://user-center-upstream;
}