CVE-2026-92468: microservices-platform through 6.0.0 Arbitrary Elasticsearch Index Read via search-center
zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/{indexName} and GET /agg/requestStat/{indexName}/{routing} path variables. Attackers can query arbitrary indices including sysuser to retrieve sensitive user records and password hashes without proper access controls.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the affected application. No user interaction is required, and the vulnerable endpoints are reachable over the network.
What data could an attacker access?
An authenticated attacker can specify arbitrary Elasticsearch index names and read their contents through the search-center service. This includes sensitive indices such as sys_user, which may expose user records and password hashes.
Which endpoints are involved?
The affected paths are POST /search/{indexName} and GET /agg/requestStat/{indexName}/{routing}. The index name is supplied as a path variable without adequate authorization controls.
Are default deployments affected?
The provided information identifies affected microservices-platform versions through 6.0.0, but does not state whether search-center is enabled or exposed in every default deployment.