CVE-2026-86261
Received Received - Intake

Authorization Bypass in Sfturing Hosp Order via userIdenf Manipulation

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impacted element is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Controller. Executing a manipulation of the argument userIdenf can lead to authorization bypass. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86261
EUVD
EUVD-2026-72237

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sfturing hosp_order to 627f426331da8086ce8fff2017d65b1ddef384f8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the sfturing hosp_order system. It allows attackers to manipulate the userIdenf argument to create appointments on behalf of other users without authentication. The flaw stems from the system relying on a user-controlled identifier instead of a valid session, enabling unauthorized access to sensitive data.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized POST requests to the OrderController endpoint with a manipulated userIdenf parameter. Check application logs for suspicious appointment creation events without valid sessions. Inspect responses for exposure of sensitive PII fields like identity numbers, mobile numbers, or emails.

Impact Analysis

An attacker could exploit this to create unauthorized appointments for victims, exposing their personally identifiable information such as identity numbers, mobile numbers, emails, names, and sex. This could lead to identity theft, fraud, or privacy violations for affected users.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing sensitive personal data without authorization. GDPR requires strict protection of personal data, while HIPAA mandates safeguards for protected health information. The unauthorized disclosure and potential misuse of PII could result in regulatory penalties.

Mitigation Strategies

Immediately enforce authentication checks before processing requests in the OrderController. Remove the userIdenf parameter from the request contract and derive user IDs solely from authenticated sessions. Restrict API responses to only necessary data for the authenticated user to prevent PII exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86261. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart