## Summary
zlt2000 microservices-platform through 6.0.0 contains a missing authorization issue (CWE-862). When zlt.security.auth.urlPermission.enable defaults to false, permission checks are disabled after authentication, allowing authenticated users with no roles to reach administrative APIs.
## Technical Details
- Root condition: the configuration flag zlt.security.auth.urlPermission.enable defaults to false, which disables authorization enforcement after authentication.
- Resulting weakness: authenticated sessions without assigned roles can access endpoints intended for administrative functions.
- The NVD description indicates access to:
- user management
- role assignment
- Elasticsearch index operations
- PoC references in the provided material include scripts targeting user update, role assignment, and password reset flows (e.g., C04_save_or_update_user.py, C06_set_role_to_user.py, C10_reset_password_by_id.py), consistent with exercising the bypassed authorization.
## Affected
- zlt2000 microservices-platform versions: through 6.0.0
## Impact
- High-impact authorization bypass: authenticated but unprivileged users (no roles) can perform administrative actions.
- Potential confidentiality/integrity/availability impact is indicated by the CVSS vector (C:H/I:H/A:H).
## Mitigation
1. Ensure zlt.security.auth.urlPermission.enable is set to enable URL permission checks (avoid the default false behavior).
2. Apply the vendor’s fixed release/patch for microservices-platform (not provided in the supplied references).
3. Review and restrict administrative API exposure; verify that authorization is enforced server-side for user management, role assignment, and Elasticsearch index operations.
4. Monitor for anomalous authenticated activity from users with no roles performing admin operations (e.g., user/role changes and password resets).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-862