CVE-2026-92469

Summary

This vulnerability allows authenticated attackers to delete arbitrary users' files and metadata by exploiting the DELETE /files/{id} endpoint in the file-center module of zlt2000 microservices-platform versions through 6.0.0, due to a lack of ownership validation.

Exploitability

Exploitation is relatively straightforward for attackers who have authenticated access and can enumerate file identifiers via the GET /files endpoint.

Blast radius

If exploited, this vulnerability could result in significant data loss and unauthorized access to sensitive files and metadata for all affected users.

Detection

Monitor authentication logs for unusual patterns of file deletion requests, especially from authenticated users who should not have such permissions.

Prioritized remediation

Upgrade to zlt2000 microservices-platform version 6.1.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.