CVE-2026-92467 microservices-platform through 6.0.0 Unverified Password Change via /users/password
HighCVSS 8.7
EPSS 0.46%
- Published
- Updated
- Exploit status
- No public exploit known
Description
zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request body and a new password to overwrite credentials of any non-administrator account without verification.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zlt2000/microservices-platform | <= 6.0.0 | No fix listed |
References
- Password change endpoint takes the target account id from the request body, at v6.0.0 technical-description
- Current-password check is skipped when oldPassword is blank, at v6.0.0 technical-description
- Reporter proof of concept: set another account's password without the current one exploit
- zlt2000/microservices-platform product
- VulnCheck Advisory: microservices-platform through 6.0.0 Unverified Password Change via /users/password third-party-advisory