zlt2000 microservices-platform versions through 6.0.0 contain a missing authorization flaw where the configuration flag zlt.security.auth.urlPermission.enable defaults to false. This setting disables all permission checks after a user is authenticated, allowing any authenticated user—even those without roles—to hit administrative endpoints such as user management, role assignment, and Elasticsearch index operations. The compromised authority is a failure of access control (CWE‑862), resulting in potential unauthorized data manipulation, privilege escalation, and exposure of sensitive information.

The vulnerability affects the microservices-platform product from vendor zlt2000, specifically version 6.0.0 and earlier releases where the URL permission flag is not enabled. Users running these versions are exposed to the described access boundaries.

The CVSS score of 8.7 classifies this vulnerability as Critical from a security perspective, and the EPSS score of less than 1 % indicates a very low probability of public exploitation at the time of the assessment. The vulnerability is not yet listed in the CISA KEV catalog. The likely attack route requires an attacker to first obtain authentication credentials; once authenticated, the attacker can leverage the disabled authorization enforcement to execute privileged administrative actions. As the flaw does not require privileged system access beyond standard authentication, the threat is significant for any organization using these versions.