CVE-2026-86260
Received Received - Intake

Password Change Manipulation in Sfturing Hosp Order

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A security flaw has been discovered in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function modifyPassWord of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java of the component Password Recovery. Performing a manipulation results in unverified password change. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86260
EUVD
EUVD-2026-72235

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sfturing hosp_order *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CWE-620 When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a password reset verification bypass in the hosp_order application. It allows unauthenticated attackers to take over user accounts by exploiting a flaw in the password-recovery flow. The issue occurs because the system authorizes password changes based on a session attribute set immediately after sending a password-reset email, without validating the emailed reset code. Attackers can reset passwords without knowing the reset code by directly calling the updatePassword endpoint after triggering a password reset.

Detection Guidance

Check for unauthorized password reset attempts or changes in logs. Monitor POST requests to /updatePassword without a valid reset token. Look for suspicious session attribute userMSG usage in CommonUserController.java logs.

Impact Analysis

This vulnerability enables remote attackers with knowledge of a registered email to take over user accounts. By bypassing the password reset verification, attackers can change passwords and gain unauthorized access to user accounts, potentially leading to data theft, account misuse, or further compromise of the system.

Compliance Impact

This vulnerability allows unauthenticated attackers to reset user passwords without validation, enabling account takeover. This could lead to unauthorized access to sensitive personal data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information if such data is stored in the system.

Mitigation Strategies

Disable the password recovery feature until patched. Implement server-side reset token validation with single-use tokens. Add rate-limiting to password reset endpoints. Review and remove premature userMSG session attribute setting in CommonUserController.java.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86260. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart