Is CVE-2026-92467 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-92467?

CVE-2026-92467 has a CVSS v3 severity of HIGH (8.3).

Back

CVE-2026-92467

Description

zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request body and a new password to overwrite credentials of any non-administrator account without verification.