CVE-2026-92467: microservices-platform through 6.0.0 Unverified Password Change via /users/password
zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request body and a new password to overwrite credentials of any non-administrator account without verification.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs to be authenticated as a user. No user interaction is required, and the attack can be performed over the network.
Which accounts can be taken over?
An authenticated attacker can overwrite the password for any non-administrator account by providing that account's user ID and a new password. The available information does not state that administrator accounts are affected.