CVE-2026-86262
Received Received - Intake

Authorization Bypass in sfturing hosp_order via userID Manipulation

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A security vulnerability has been detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation of the argument userID/id leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86262
EUVD
EUVD-2026-72239

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sfturing hosp_order to 627f426331da8086ce8fff2017d65b1ddef384f8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the sfturing hosp_order project. It allows unauthenticated users to modify appointment states and medical details or view another user's appointment metadata by manipulating the userID or id parameters in the POST /orderUserCenter endpoint. The issue occurs because updates are performed before session checks and MyBatis queries lack proper user-appointment binding.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized POST requests to the /orderUserCenter endpoint. Check logs for requests with userID, id, or diseaseInfo parameters without valid session cookies. Use tools like Wireshark or tcpdump to capture suspicious HTTP POST requests targeting this endpoint.

Impact Analysis

An attacker could exploit this to modify any appointment's state or medical details without authentication, leading to appointment fraud or data integrity loss. They could also view another user's appointment metadata, resulting in unauthorized disclosure of health-service activity.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal health data (appointment metadata) and potential data integrity issues. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for protected health information. Exploitation could lead to non-compliance penalties.

Mitigation Strategies

Immediately enforce authentication checks for the /orderUserCenter endpoint. Validate that the userID in requests matches the session owner before processing. Update the application to ignore client-supplied user IDs and ensure MyBatis queries bind user-appointment ownership. Patch the OrderController.java file to perform session validation before any data modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86262. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart