CVE-2026-86260 in hosp_order
Summary
by MITRE • 09/07/2026
A security flaw has been discovered in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function modifyPassWord of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java of the component Password Recovery. Performing a manipulation results in unverified password change. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in the sfturing hosp_order component represents a critical authentication bypass within the password recovery mechanism. Specifically, the flaw resides in the modifyPassWord function located in the CommonUserController.java file under the ssm_pro source directory. This architectural weakness allows an attacker to manipulate the request parameters associated with changing user passwords without proper verification of identity or ownership. The core technical issue is a failure to enforce strict access controls and validation checks before processing password modification requests, effectively rendering the authentication gate ineffective for this specific operation.
From a classification perspective, this vulnerability aligns closely with CWE-287, which denotes Improper Authentication, as well as CWE-613, Insufficient Session Expiration. The lack of verification means that any entity capable of sending HTTP requests to the affected endpoint can potentially reset passwords for arbitrary user accounts. This is not a case of privilege escalation within an authenticated session but rather a complete bypass of the authentication requirement for account takeover via password recovery features.
The operational impact of this flaw is severe, as it directly compromises the confidentiality and integrity of user credentials. An attacker who exploits this vulnerability can gain unauthorized access to any user account by resetting its password. This capability facilitates further malicious activities such as data exfiltration, lateral movement within internal networks if those accounts have broader permissions, or defacement of services associated with compromised identities. The fact that the exploit has been released publicly significantly lowers the barrier for entry, allowing less sophisticated threat actors to conduct automated attacks against vulnerable instances.
Remote exploitation is feasible because the vulnerability exists in a web-facing controller method likely exposed via HTTP/HTTPS endpoints. Attackers can craft specific requests targeting the modifyPassWord endpoint with manipulated parameters that bypass internal validation logic. Since the product utilizes a rolling release model, determining exact affected versions based on version numbers is not possible; instead, organizations must assess whether they are running any build prior to or including commit 627f426331da8086ce8fff2017d65b1ddef384f8. The lack of response from the project maintainers despite early notification suggests that users may need to implement compensating controls until an official patch is available.
Mitigation strategies should focus on immediate defensive measures given the public availability of exploits and the absence of a vendor-provided fix. Organizations hosting this service should immediately restrict access to the password recovery endpoints using Web Application Firewall rules or network-level ACLs if possible. Implementing rate limiting on authentication-related APIs can also help mitigate brute-force attempts that might accompany exploitation efforts. Additionally, enforcing multi-factor authentication for all user accounts adds a critical layer of defense that remains effective even if passwords are compromised through this vulnerability. Developers must review the modifyPassWord implementation to ensure it validates session tokens, verifies ownership of the account being modified, and requires confirmation via secure channels such as email or SMS before allowing password changes.