CVE-2026-86263: medium-severity vulnerability in sfturing hosp_order
sfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.6%
A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ID results in authorization bypass. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
sfturing · hosp_orderpublic PoCs found — 1
cve_referencegithub.com/sfturing/hosp_order/issues/116unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — sfturing hosp_order
In the same product, most dangerous first.
CVE-2026-86260MEDIUMsfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password changeEPSS 0.6%CVE-2026-86262MEDIUMsfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorizationEPSS 0.6%CVE-2026-86261MEDIUMsfturing hosp_order Order Controller OrderController.java authorizationEPSS 0.6%CVE-2026-95396MEDIUMsfturing hosp_order Public Search Handlers HospitalController.java cross site scriptingEPSS 0.5%CVE-2026-96548MEDIUMsfturing hosp_order jdbc.properties hard-coded credentialsEPSS 0.4%CVE-2025-6766MEDIUMsfturing hosp_order OfficeServiceImpl.java getOfficeName sql injectionEPSS 0.4%