EUVD-2026-80705
GHSA-pc4j-h2fr-9v52
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryCraft PUT /users/password with target user id
-
ExploitServer skips current-password check
-
ExecutionOverwrite victim credentials
-
ImpactLog in and take over non-admin account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Password change verification
|
| Exploitation Conditions | Requires a valid authenticated session as a low-privilege user (PR:L) on the zlt2000 microservices-platform (through 6.0.0); the attacker calls the PUT /users/password endpoint and supplies an arbitrary target user id plus a new password. The vulnerable code path (SysUserController/SysUserServiceImpl) does not verify the current password, so no knowledge of the victim's existing credentials is needed. Limiting factors: exploitation is explicitly restricted to non-administrator accounts, and an authenticated account on the platform is a prerequisite - it is not exploitable pre-authentication. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L, base 8.7) describes a network-reachable, low-complexity flaw requiring only a low-privilege authenticated account - no user interaction. This is well-calibrated for an authenticated horizontal-privilege-escalation / account-takeover bug: PR:L is the honest limiter, and VA:L (rather than VA:H) correctly reflects that the primary damage is credential overwrite and victim lockout rather than a full service outage. A public POC exists (VulnCheck advisory plus a GitHub exploit script), so exploitation is trivial for anyone with a foothold. No CISA KEV listing and no EPSS score are provided in the input, so there is no evidence of active in-the-wild exploitation; the signal set (public POC + genuine authenticated ATO) points to a real, easily-weaponizable issue whose real-world urgency is tempered by (a) the requirement for an existing authenticated session and (b) the exploit being explicitly limited to non-administrator accounts. Net: a genuine priority for anyone running this platform, but the PR:L gate and non-admin scope keep it below a pre-auth-RCE tier. No key signals conflict; the main data gaps are the absence of EPSS/KEV rather than contradictions. |
| Exploit ScenarioDerived | A low-privileged but authenticated user of the microservices-platform sends a crafted PUT /users/password request containing another user's id and a new password, omitting the current-password value the endpoint fails to verify. The server overwrites the victim's credentials, letting the attacker log in as that (non-administrator) user and access their data. A public Python POC (C09_reset_any_user_password.py) automates this end to end. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authenticated users of zlt2000 microservices-platform through 6.0.0 can overwrite the password of any non-administrator account by calling the PUT /users/password endpoint with an arbitrary user id and a new password, because the server never verifies the current password. The flaw is network-reachable, low-complexity, and requires only a low-privilege login session (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:L), and publicly available exploit code exists. Exploitation is limited to non-administrator accounts and is not possible pre-authentication, but a successful attack yields full credential takeover of the targeted account.
RemediationAI
No vendor-released patch identified at time of analysis, so remediation must begin with compensating controls while a fixed release is awaited. Immediately restrict access to the PUT /users/password endpoint at the API gateway or reverse proxy so that only trusted administrative roles can invoke it; this breaks legitimate self-service password changes for regular users, so a separate, correctly implemented self-service flow should be provided. Alternatively, add a mandatory current-password verification step in SysUserController/SysUserServiceImpl before applying the new value, and bind the target user id to the authenticated principal's identity so a caller cannot change another account. If neither code change nor endpoint restriction is feasible in the short term, block the endpoint entirely and handle password resets out-of-band. After applying any mitigation, force password resets and session invalidation for non-administrator accounts that may have been targeted, and monitor logs for PUT /users/password requests where the body user id differs from the session's authenticated user. Review the downstream commits in the upstream repository (https://github.com/zlt2000/microservices-platform) for a future tagged fix, and consult https://www.vulncheck.com/advisories/microservices-platform-through-6.0.0-unverified-password-change-via-users-password for updated guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-620 (Unverified Password Change) is the root cause: the password-change flow trusts the caller-supplied user id in the PUT /users/password body and applies the new password without re-authenticating the requester or confirming knowledge of the account's existing password. The affected code path lives in the user-center microservice of zlt2000 microservices-platform, specifically SysUserController.java (line 206) and SysUserServiceImpl.java (line 165) at tag v6.0.0, where the service implementation updates the credential record based solely on the supplied id and new value. Because the service is a Spring Cloud-based microservice deployment, the endpoint is typically reachable through the API gateway without additional per-user binding checks. The CPE cpe:2.3:a:zlt2000:microservices-platform:*:*:*:*:*:*:*:* reflects that the advisory covers the platform through version 6.0.0; the vulnerable behavior is a logic/authz defect rather than a memory-safety bug, so it survives standard input validation and requires code-level correction to bind the password change to the authenticated principal.
Know when Microservices Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Network endpoint reachable with any authenticated low-priv account (PR:L, AC:L); account takeover yields high confidentiality/integrity of victim data and partial availability (lockout), scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request body and a new password to overwrite credentials of any non-administrator account without verification.
Technical POC Analysis
Evidence note: the supplied artifact is the exploit script (C09resetanyuserpassword.py).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
zlt2000 microservices-platform through 6.0.0 contains a high-severity flaw that lets any authenticated low-privilege user reset passwords for non-administrator accounts, enabling credential takeover and potential access to sensitive business functions; publicly available exploit code exists. Leadership should care because the issue is network-reachable, no vendor-released patch has been identified, and affected accounts can be compromised at scale by users with only a basic login.
No vendor-released patch identified at time of analysis. Restrict access to PUT /users/password, enforce least privilege and MFA, monitor and alert on password-change calls, audit and rotate non-administrator credentials, and isolate affected zlt2000 microservices-platform 6.0.0 instances until a fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Microservices Platform
View allMissing authorization in zlt2000 microservices-platform through 6.0.0 lets any authenticated account - including one wit
Arbitrary file deletion in zlt2000 microservices-platform through 6.0.0 allows authenticated attackers to delete any use
Authenticated attackers can read arbitrary Elasticsearch indices in zlt2000 microservices-platform through 6.0.0 by supp
A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0. Rated medium severity (CVSS 5.3), this vul
Exploit-DB