The zlt2000 microservices-platform versions up to and including 6.0.0 contain an unverified password change vulnerability in the PUT /users/password endpoint. Authenticated users can exploit this flaw by omitting the current password verification step and supplying an arbitrary user ID and new password in the request body. This enables them to overwrite the credentials of any non-administrator account without proper authorization checks. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

An attacker with authenticated access can change passwords of any non-administrator user accounts without knowing their current passwords. This could lead to unauthorized account takeover and potential lateral movement within the affected system. Administrator accounts are not affected by this vulnerability according to the description.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to prevent unauthorized password changes and monitor for suspicious activity related to password modifications.