The zlt2000 microservices-platform versions up to and including 6.0.0 contain a missing authorization vulnerability due to the default setting of the zlt.security.auth.urlPermission.enable flag being false. This configuration disables all permission enforcement after authentication, enabling authenticated users without roles to bypass authorization controls and access administrative APIs. These APIs include critical functions like user management, role assignment, and Elasticsearch index operations, potentially leading to unauthorized administrative actions.

Authenticated users without any assigned roles can bypass authorization controls and access administrative APIs. This could lead to unauthorized user management, role assignments, and manipulation of Elasticsearch indexes, potentially compromising system integrity and confidentiality. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to manually verify and set the zlt.security.auth.urlPermission.enable flag to true to ensure permission checks are enforced after authentication. Restrict access to the affected microservices-platform to trusted users only and monitor for unauthorized administrative API usage.