What is the CVSS score of EUVD-2026-80706?

EUVD-2026-80706 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for EUVD-2026-80706?

Yes, a public proof-of-concept exploit is available for EUVD-2026-80706. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2026-80706?

Within 24 hours, confirm exposure and restrict network access to the zlt2000 microservices-platform search-center service, preferably behind VPN or allowlisted IPs, and block or disable the /search/{indexName} and /agg/requestStat/{indexName}/{routing} endpoints at the gateway/WAF if business operations permit; review Elasticsearch and application logs for unauthorized index access and rotate credentials for any accounts or services with access to exposed indices, especially if the sys_user index may have been read. Within 7 days, implement server-side index allowlisting for the search-center service so only explicitly permitted indices can be queried, enforce least privilege for the underlying Elasticsearch service account, and confirm the platform is not exposed to untrusted networks; because no vendor-released patch is identified for zlt2000 microservices-platform through 6.0.0, monitor the vendor for an updated version and prepare an upgrade plan. Within 30 days, apply the vendor patch once released for the affected zlt2000 microservices-platform version, or migrate to a fixed release if one becomes available, then re-test the endpoints to confirm the authorization bypass is closed and review credential rotation and monitoring controls to prevent recurrence.

zlt2000 microservices-platform EUVD-2026-80706

| CVE-2026-92468 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-09-16 VulnCheck

GHSA-hj6r-7gmv-7mph

Authentication Bypass Java Elastic Microservices Platform

7.1

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate with low-privilege account
Delivery

Send POST /search/{indexName} with target index
Exploit

Bypass missing index authorization check
Execution

Read arbitrary Elasticsearch index (sys_user)
Impact

Exfiltrate user records and password hashes

Vulnerability Assessment

Weakness	CWE CWE-639 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Object-level authorization, IDOR prevention
Exploitation Conditions	Requires a valid authenticated session on the microservices-platform (PR:L) - any low-privilege user account suffices; no admin rights, user interaction, or non-default configuration is needed, and the search-center service must be network-reachable. Exploitation targets the vulnerable path variables in POST /search/{indexName} and GET /agg/requestStat/{indexName}/{routing}, where the {indexName} value is trusted without an authorization check. The only meaningful limiting factor is the need for authentication; there are no other special prerequisites, and public POC code lowers the practical barrier further.
Impact	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity insecure-direct-object-reference (IDOR/CWE-639) that requires an authenticated but low-privilege account (PR:L) and yields high confidentiality impact only - no integrity or availability effect. The 7.1 score is well-calibrated: the PR:L gate and read-only impact keep it below the pre-auth full-triad tier, but the confidentiality damage is genuine because arbitrary Elasticsearch indices - including sys_user with password hashes - are exposed. Publicly available exploit code exists (two VulnCheck-referenced POC scripts), which materially raises practical risk versus a theoretical bug. No EPSS score, no CISA KEV listing, and no SSVC data were provided, so exploitation status is 'publicly available exploit code exists' - not confirmed active exploitation. Net: a real, easily-weaponized data-disclosure priority for anyone running this platform, tempered mainly by its niche footprint and the need for any valid low-privilege credential.
Exploit ScenarioDerived	An attacker with any authenticated low-privilege account on the microservices-platform sends POST /search/sys_user (or GET /agg/requestStat/sys_user/{routing}), substituting an arbitrary index name into the path variable to bypass authorization checks. Because the service does not validate which index the caller may read, it returns sensitive records including user accounts and password hashes. Public POC scripts (C24_search_any_index.py and C22_request_stat_agg.py) automate both the search and aggregation endpoints.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

2 PoC candidates (unverified) No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 16, 2026

Authenticated attackers can read arbitrary Elasticsearch indices in zlt2000 microservices-platform through 6.0.0 by supplying any index name in the POST /search/{indexName} or GET /agg/requestStat/{indexName}/{routing} endpoints, bypassing authorization checks. This exposes sensitive data such as the sys_user index containing user records and password hashes; the vulnerability has a CVSS 4.0 base score of 7.1 and an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning high confidentiality impact with no integrity or availability effect. Publicly available exploit code exists (no CISA KEV confirmation), and exploitation requires only a valid low-privilege session on a network-reachable search-center service.

RemediationAI

No vendor-released patch is identified in the provided data for zlt2000 microservices-platform through 6.0.0; monitor the project repository (https://github.com/zlt2000/microservices-platform) and the VulnCheck advisory (https://www.vulncheck.com/advisories/microservices-platform-through-6.0.0-arbitrary-elasticsearch-index-read-via-search-center) for an updated release. Until a patch is available, restrict network access to the search-center service so that only trusted internal services or known authorized clients can reach POST /search/{indexName} and GET /agg/requestStat/{indexName}/{routing}; this reduces exposure but may break legitimate distributed search functionality if other microservices rely on direct calls. Enforce an index allowlist or authorization check at the API gateway or a service mesh so that any authenticated user can only query indices tied to their role/tenant, and reject or strip user-supplied {indexName} values that are not explicitly permitted; this is the most direct control but requires changes to gateway rules or a proxy and may require careful mapping of legitimate index names. If the full search-center functionality is not required, disable or block the vulnerable endpoints entirely. Because public POC code exists (C24_search_any_index.py and C22_request_stat_agg.py at https://github.com/LinYuanyi1/cve-request-poc), treat any authenticated user as a potential exploitation source and monitor Elasticsearch audit logs for anomalous index access, especially queries against sys_user or other sensitive indices. Rotate credentials and password hashes if exposure is suspected.

Affected VersionsENISA

microservices-platform 0 ≤6.0.0

Affected Packages

euvd microservices_platform no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

zlt2000 microservices-platform is a Spring Cloud-based microservices project with a search-center service (search-server) that proxies queries to Elasticsearch. The affected controllers are SearchController and AggregationController, where path variables {indexName} and {routing} are accepted and passed to Elasticsearch without verifying that the authenticated user is authorized to access the specified index. This is a classic CWE-639 authorization bypass through user-controlled key (insecure direct object reference): the server trusts the client-supplied index name as the target of the query rather than deriving it from a fixed, authorized per-user or per-role context. The CPE cpe:2.3:a:zlt2000:microservices-platform:*:*:*:*:*:*:*:* indicates all versions through 6.0.0 are affected, and the issue is network-reachable (AV:N) with low attack complexity (AC:L) once a low-privilege authenticated session exists (PR:L). No integrity or availability impact is expected because the vulnerable operation is a read-only search/aggregation query, though the confidentiality impact is high (VC:H) because indices such as sys_user can contain password hashes and other sensitive records.

Know when Microservices Platform gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI 6.5 MEDIUM

Network-reachable IDOR needing any low-privilege account (PR:L, AC:L); read-only arbitrary index disclosure gives C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/{indexName} and GET /agg/requestStat/{indexName}/{routing} path variables. Attackers can query arbitrary indices including sys_user to retrieve sensitive user records and password hashes without proper access controls.

Technical POC Analysis

Evidence note: the two supplied files are Python PoC scripts, not a source diff.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Latest POC

2 PoC candidates from github (unverified)

Executive ViewAI

Why It Matters

zlt2000 microservices-platform through 6.0.0 contains a high-severity authorization bypass that lets any authenticated low-privilege user read arbitrary Elasticsearch indices, including the sys_user index with user records and password hashes. Organizations running the affected search-center service on network-reachable infrastructure are exposed to credential compromise and follow-on lateral movement, even though the flaw does not affect integrity or availability. Leadership should prioritize containment and credential-risk assessment; publicly available exploit code exists and no vendor-released patch identified at time of analysis.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to the search-center service to trusted users, implementing server-side index allowlisting for /search/{indexName} and /agg/requestStat/{indexName}/{routing}, blocking or disabling those endpoints at the gateway/WAF, monitoring for anomalous index access, and rotating credentials if compromise is suspected.

Threat Intelligence Overview

EPSS Score

0.4%

Top 70% exploitable

Prevalence

Low

niche open-source Chinese Spring Cloud microservices scaffold, limited production footprint

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.