Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92467microservices-platform through 6.0.0 Unverified Password Change via /users/password

High 8.3

In plain English

A high-severity security flaw in microservices-platform from zlt2000. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.5%top 60.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request body and a new password to overwrite credentials of any non-administrator account without verification.

Affected products (as reported)

Vendor	Product	Versions
zlt2000	microservices-platform	0 – through 6.0.0

Weakness: CWE-620 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

Password change endpoint takes the target account id from the request body, at v6.0.0 technical-description
Current-password check is skipped when oldPassword is blank, at v6.0.0 technical-description
Reporter proof of concept: set another account's password without the current one exploit
zlt2000/microservices-platform product
VulnCheck Advisory: microservices-platform through 6.0.0 Unverified Password Change via /users/password third-party-advisory