CVE-2026-92469: microservices-platform through 6.0.0 Arbitrary File Deletion via Missing Ownership Check
zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/{id} endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metadata by supplying their identifiers to the delete endpoint.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs an authenticated account with permission to call the file-center API. No user interaction is required, and the attack can be performed over the network.
How would an attacker identify files belonging to other users?
Authenticated attackers can enumerate file identifiers through the GET /files endpoint, then submit those identifiers to DELETE /files/{id}. The deletion can affect other users' files and associated metadata.
Which versions are known to be affected?
zlt2000 microservices-platform through version 6.0.0 is identified as affected. The provided data does not identify a fixed version.
What is the impact if the vulnerability is exploited?
An authenticated attacker can delete arbitrary users' files and metadata. The reported impact is loss of integrity and availability, with no reported confidentiality impact.