CVE-2026-86263 in hosp_order
Summary
by MITRE • 09/07/2026
A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ID results in authorization bypass. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The identified vulnerability resides within the sfturing hosp_order component, specifically affecting versions up to commit hash 627f426331da8086ce8fff2017d65b1ddef384f8. This security flaw is located in the orderRecordsService.cancelOrder function within the OrderController.java file of the ssm_pro source code base. The core technical issue stems from an improper implementation of access control mechanisms, allowing for a direct authorization bypass. By manipulating the ID argument passed to this endpoint, an attacker can circumvent standard authentication and authorization checks that are intended to verify whether the requesting user has permission to cancel specific orders. This type of flaw is classically categorized under CWE-285 Improper Authorization, where the software does not properly enforce restrictions on actions performed by authenticated users or external actors.
The operational impact of this vulnerability is significant as it allows for unauthorized modification of order statuses within the healthcare ordering system. Since the exploit targets the cancellation logic, an attacker could potentially cancel orders belonging to other patients or administrative entities without proper credentials or permissions. This not only disrupts business operations but also poses serious risks to data integrity and patient care continuity in a hospital setting. The ability to perform this manipulation remotely means that no physical access or local network proximity is required, increasing the attack surface considerably. Furthermore, because the exploit code is now public, automated scanning tools and malicious actors can readily leverage these techniques to target vulnerable instances of the software without needing custom development efforts.
The deployment model of sfturing utilizes a rolling release system for continuous delivery, which complicates traditional vulnerability management practices. Because version information for affected or updated releases is not explicitly disclosed through standard semantic versioning, identifying whether a specific instance is vulnerable requires deep code analysis rather than simple version string comparison. This lack of clear version delineation can lead to delayed patch adoption and increased exposure windows. The project maintainers were notified early via an issue report but have yet to respond or provide a fix, leaving the community without official mitigation guidance from the vendor side.
To mitigate this risk in the absence of an immediate vendor patch, organizations should implement strict input validation on all order ID parameters received by the cancelOrder endpoint. It is critical that the backend service verifies not only that the user is authenticated but also that they possess explicit authorization to act upon the specific resource identified by the provided ID. This aligns with ATT&CK technique T1078 Valid Accounts, as attackers often leverage stolen or forged credentials; however, robust object-level access control can prevent even valid accounts from performing unauthorized actions on resources they do not own. Additionally, deploying a Web Application Firewall (WAF) with rulesets designed to detect anomalous patterns in order cancellation requests may provide an additional layer of defense against exploitation attempts while the vendor addresses the underlying code defect.