CVE-2026-86262: sfturing hosp_order Auth Bypass Vulnerability

CVE-2026-86262 Overview

CVE-2026-86262 is an authorization bypass vulnerability [CWE-285] in the sfturing/hosp_order project, a hospital order management application. The flaw affects the updateOrderSta1 and updateOrderdiseaseInfo functions within ssm_pro/src/main/java/cn/sfturing/web/OrderController.java in the Order Handler component. Attackers can manipulate the userID and id arguments to bypass authorization checks remotely without authentication. The exploit has been publicly disclosed. The project follows a rolling release model, so no fixed version identifiers exist. The maintainers were notified through an issue report but had not responded at the time of disclosure.

Critical Impact
Unauthenticated remote attackers can bypass authorization controls to modify order status and disease information belonging to other users.

Affected Products

sfturing hosp_order (rolling release)
Commit range up to 627f426331da8086ce8fff2017d65b1ddef384f8
OrderController.java component within the ssm_pro module

Discovery Timeline

2026-09-07 - CVE-2026-86262 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86262

Vulnerability Analysis

The vulnerability resides in the OrderController class of the hosp_order Spring MVC application. Two handler methods, updateOrderSta1 and updateOrderdiseaseInfo, accept the userID and id request parameters without verifying whether the caller owns the referenced order. Because the controller trusts the client-supplied identifier, an attacker can substitute any value and operate on records belonging to other users.

The attack requires no credentials and no user interaction. It can be delivered over the network through standard HTTP requests to the vulnerable endpoints. Successful exploitation allows tampering with order state and clinical disease metadata, undermining data integrity in a healthcare-adjacent workflow.

Root Cause

The root cause is missing authorization enforcement in the request-handling layer. The controller methods perform their update actions based on the identifier submitted in the request rather than reconciling that identifier against the authenticated session. This maps directly to CWE-285 (Improper Authorization).

Attack Vector

An attacker sends an HTTP request to the updateOrderSta1 or updateOrderdiseaseInfo endpoint and supplies a userID or id value corresponding to another user's record. The application processes the update without an ownership check. Full technical details are documented in the VulDB entry for CVE-2026-86262 and the upstream GitHub Issue #115.

No verified proof-of-concept code is republished here. Refer to the GitHub PoC Repository for the source under analysis.

Detection Methods for CVE-2026-86262

Indicators of Compromise

Unexpected changes to order status records or disease information fields with no corresponding user session activity.
HTTP requests to updateOrderSta1 or updateOrderdiseaseInfo endpoints containing userID or id values that do not match the authenticated session identity.
Repeated sequential or enumerated values in the id parameter suggesting object identifier brute-forcing.

Detection Strategies

Enable application-layer logging on the OrderController endpoints and correlate the submitted userID with the session principal on every request.
Deploy a web application firewall rule to alert when POST requests to the affected paths originate from unauthenticated sessions.
Perform periodic audits comparing order ownership metadata against the account that last modified each record.

Monitoring Recommendations

Ingest webserver and application logs into a centralized analytics platform and alert on parameter-tampering patterns targeting order endpoints.
Track anomalous request volume against the two vulnerable handlers, especially from single source IPs iterating identifier values.
Monitor database write operations against the orders and disease-info tables for updates lacking an authenticated user context.

How to Mitigate CVE-2026-86262

Immediate Actions Required

Restrict network exposure of the hosp_order application to trusted internal networks pending an upstream fix.
Place an authenticating reverse proxy in front of the application and reject unauthenticated requests to updateOrderSta1 and updateOrderdiseaseInfo.
Review historical logs for prior parameter-tampering requests and audit affected order and disease records for unauthorized modification.

Patch Information

No vendor patch has been released. The project uses a rolling release strategy, and the maintainer had not responded to the upstream GitHub Issue #115 at the time of disclosure. Operators should track the sfturing/hosp_order repository for future commits addressing authorization checks in OrderController.java.

Workarounds

Modify updateOrderSta1 and updateOrderdiseaseInfo locally to resolve the acting user from the authenticated session (for example, Spring Security's Principal) and reject requests where the requested userID or id does not belong to that principal.
Add a server-side ownership check that queries the order record and verifies the owning user before applying updates.
Disable or firewall the two affected endpoints if they are not required in the deployment.

bash

# Example nginx location block to block unauthenticated access
# to the vulnerable endpoints until a code fix is deployed
location ~ ^/(updateOrderSta1|updateOrderdiseaseInfo) {
    if ($http_cookie !~* "JSESSIONID=") {
        return 403;
    }
    proxy_pass http://hosp_order_backend;
}