The zlt2000 microservices-platform through version 6.0.0 contains an authorization bypass vulnerability in the file-center module. Specifically, the DELETE /files/{id} endpoint lacks ownership validation, allowing authenticated attackers to enumerate file identifiers using the GET /files endpoint and delete arbitrary users' files and metadata by supplying those identifiers to the delete endpoint. This vulnerability has a CVSS 4.0 base score of 7.2, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and high impact on integrity and availability.

An authenticated attacker can delete files and metadata belonging to other users without proper authorization checks. This compromises data integrity and availability for affected users, potentially leading to data loss or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the DELETE /files/{id} endpoint to trusted users only and monitor for suspicious deletion activity. Implement additional access control checks at the application level if possible.