What is the CVSS score of CVE-2026-92469?

CVE-2026-92469 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2026-92469?

Yes, a public proof-of-concept exploit is available for CVE-2026-92469. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-92469?

Within 24 hours, confirm whether the zlt2000 microservices-platform file-center module (versions through 6.0.0) is deployed in production, identify all accounts and service integrations holding file-center REST API permissions, and restrict DELETE access on the /files/{id} endpoint at the gateway, reverse proxy, or WAF layer to a minimal set of trusted administrators while logging all attempts; also verify the integrity and independence of backups for file data and metadata. Within 7 days, inventory all affected instances and versions, apply any hotfix or updated release the vendor publishes, and if none is available, deploy a virtual patch or gateway rule that enforces ownership validation on DELETE requests and tighten least-privilege review of file-center roles, revoking broad enumeration rights on GET /files. Within 30 days, migrate off any unsupported version through 6.0.0 to a vendor-supported build once released, implement tamper-evident audit logging and alerting on bulk or anomalous file deletions, run a tabletop or controlled test of file restoration from backups, and add the file-center module to routine vulnerability and change-management review until the vendor provides a permanent fix.

zlt2000 microservices-platform CVE-2026-92469

EUVD-2026-80707 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-09-16 VulnCheck

GHSA-x7gm-hm27-4pgr

Authentication Bypass Java Microservices Platform

7.2

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate with any valid account
Exploit

Enumerate file IDs via GET /files
Execution

Send DELETE /files/{id} for others' files
Impact

Delete arbitrary files and metadata

Vulnerability Assessment

Weakness	CWE CWE-639 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Object-level authorization, IDOR prevention
Exploitation Conditions	Exploitation requires an authenticated account on the zlt2000 microservices-platform (PR:L) with access to the file-center module's REST API. The specific prerequisite is any valid session that can reach GET /files (to enumerate arbitrary file identifiers) and DELETE /files/{id}; no ownership, role, or additional privilege check is enforced on the delete path, so a normal low-privilege user suffices. No user interaction and no non-default configuration are needed - the missing ownership check exists in the shipped code path. The primary limiting factor is the authentication requirement; impact is restricted to deletion/loss of files and metadata (integrity and availability), with no data disclosure.
Impact	This is a genuine, actionable authorization-bypass (IDOR/BOLA, CWE-639) affecting the file-center module of zlt2000 microservices-platform through 6.0.0. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H, base 7.2) is well-calibrated: network-reachable, low complexity, but gated behind PR:L (any authenticated account), with impact confined to integrity (unauthorized deletion of others' files/metadata) and availability (permanent data loss) - confidentiality is untouched (VC:N), consistent with a delete-only primitive. The strongest real-world signal is that a public POC exists (VulnCheck advisory plus a working script), which raises practical exploitability above a theoretical high-CVSS issue. Counterbalancing factors: no CISA KEV listing and no EPSS score are provided, so there is no evidence of active or widespread exploitation - the presence of exploit code should not be conflated with in-the-wild use. The PR:L requirement means an attacker needs a valid (even low-privilege) account, and the affected product is a niche open-source platform, both of which constrain the realistic blast radius. Net: a real, patch-worthy priority for anyone running this platform, but not an emergency-class internet-wide threat.
Exploit ScenarioDerived	A user with any authenticated account on the platform calls GET /files to enumerate file identifiers belonging to other users, then issues DELETE /files/{id} against those identifiers; because the endpoint performs no ownership check, the target files and their metadata are destroyed. A public POC (LinYuanyi1/cve-request-poc C19_delete_any_file.py, referenced by VulnCheck) automates this arbitrary-file-deletion flow, lowering the skill needed to weaponize it.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

1 PoC candidate (unverified) No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 16, 2026

Arbitrary file deletion in zlt2000 microservices-platform through 6.0.0 allows authenticated attackers to delete any user's files and metadata due to missing ownership validation in the file-center module's DELETE /files/{id} endpoint. Attackers can enumerate file identifiers via GET /files and then delete arbitrary files, bypassing authorization controls (CWE-639); publicly available exploit code exists. Exploitation requires a valid, low-privilege account (PR:L) with access to the file-center REST API, and the impact is limited to integrity and availability (no data disclosure), with a CVSS 4.0 base score of 7.2.

RemediationAI

No vendor-released patch identified at time of analysis. Until a patch is available, implement an ownership check in the file-center module's DELETE /files/{id} handler (FileController.java) to verify that the authenticated user owns the file before deletion. As a compensating control, restrict access to the file-center REST API to trusted users or roles, or temporarily disable the DELETE endpoint if not essential; however, disabling it will break legitimate file management workflows. Monitor for anomalous DELETE requests. Refer to the VulnCheck advisory (https://www.vulncheck.com/advisories/microservices-platform-through-6.0.0-arbitrary-file-deletion-via-missing-ownership-check) and the project repository (https://github.com/zlt2000/microservices-platform) for updates. A public exploit script exists, so prioritize mitigation if the module is exposed.

Affected VersionsENISA

microservices-platform 0 ≤6.0.0

Affected Packages

euvd microservices_platform no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is an instance of CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an IDOR/BOLA flaw. The affected component is the file-center module of zlt2000 microservices-platform, a Java-based microservices framework (repository: https://github.com/zlt2000/microservices-platform). The vulnerable code is in FileController.java at line 48, where the DELETE /files/{id} endpoint accepts a file identifier without verifying that the authenticated user owns or has permission to delete the referenced file. The platform uses REST APIs and likely a Spring Boot stack; the CPE cpe:2.3:a:zlt2000:microservices-platform:* indicates all versions up to 6.0.0 are affected. Because the GET /files endpoint discloses file identifiers, an authenticated attacker can enumerate IDs and then delete arbitrary users' files and metadata. A public exploit script (C19_delete_any_file.py) is available, and no non-default configuration or user interaction is required.

Know when Microservices Platform gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 8.1 HIGH

Network REST endpoint reachable by any authenticated user (PR:L, AC:L, UI:N); arbitrary deletion destroys others' data giving I:H/A:H, with no read access so C:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/{id} endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metadata by supplying their identifiers to the delete endpoint.

Technical POC Analysis

Evidence note: the supplied artefact is an exploit client (microservice-platform/C19deleteanyfile.py, mislabelled "PATCHED SOURCE" in its filename banner).

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Latest POC

1 PoC candidate from github (unverified)

Executive ViewAI

Why It Matters

A high-severity flaw in the zlt2000 microservices-platform file-center module allows any user with a basic account to delete files belonging to other users, including associated metadata, across the organization. Because exploitation requires only a valid low-privilege login and working exploit code is already public, the barrier to abuse is low and the risk is not limited to external attackers - any employee, contractor, or compromised account with API access could irreversibly destroy business records. Leadership should treat this as an operational continuity and internal-threat exposure issue, not merely a technical defect, since deleted files may be unrecoverable and could disrupt services depending on the platform.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict DELETE access on the /files/{id} endpoint to a minimal set of trusted administrative accounts via API gateway, reverse proxy, or WAF rules; enforce ownership validation server-side or through a virtual patch; tighten least-privilege roles and revoke broad GET /files enumeration permissions; require strong authentication for file-center access; enable tamper-evident audit logging and alerting on anomalous or bulk deletions; and verify offline, restorable backups of file data and metadata.

Threat Intelligence Overview

EPSS Score

0.5%

Top 58% exploitable

Prevalence

Low

niche open-source Java/Spring Cloud microservices platform, no broad enterprise footprint

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.