CVE-2026-92468

Impact

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/{indexName} and GET /agg/requestStat/{indexName}/{routing} path variables. Attackers can query arbitrary indices including sys_user to retrieve sensitive user records and password hashes without proper access controls.

Affected products

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C22_request_stat_agg.py
• https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C24_search_any_index.py
• https://github.com/zlt2000/microservices-platform
• https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-business/search-center/search-server/src/main/java/com/central/search/controller/AggregationController.java#L33
• https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-business/search-center/search-server/src/main/java/com/central/search/controller/SearchController.java#L36
• https://www.vulncheck.com/advisories/microservices-platform-through-6.0.0-arbitrary-elasticsearch-index-read-via-search-center
• https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C22_request_stat_agg.py