CVE-2026-86263: sfturing hosp_order Auth Bypass Vulnerability

CVE-2026-86263 Overview

CVE-2026-86263 is an authorization bypass vulnerability [CWE-285] affecting the sfturing/hosp_order project, a hospital order management application. The flaw resides in the orderRecordsService.cancelOrder function within ssm_pro/src/main/java/cn/sfturing/web/OrderController.java, part of the Order Cancellation component. An attacker can manipulate the ID argument to cancel orders belonging to other users without proper authorization checks. The exploit is publicly available and can be executed remotely without authentication or user interaction. The project uses a rolling release model, so fixed version identifiers are not published.

Critical Impact
Remote unauthenticated attackers can bypass authorization controls and cancel arbitrary hospital orders by manipulating the ID parameter.

Affected Products

sfturing hosp_order (all versions up to commit 627f426331da8086ce8fff2017d65b1ddef384f8)
Rolling release: no fixed version identifier disclosed
Component: Order Cancellation (OrderController.java)

Discovery Timeline

2026-09-07 - CVE-2026-86263 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86263

Vulnerability Analysis

The vulnerability affects the cancelOrder method exposed through OrderController.java in the ssm_pro module of the hosp_order application. The endpoint accepts an order ID parameter but fails to verify that the requesting user owns or has permission to cancel the referenced order. Because the check is absent, any remote caller can supply an arbitrary ID and trigger cancellation logic on records belonging to other users.

The issue is categorized under CWE-285 (Improper Authorization). The current EPSS probability of exploitation in the next 30 days is approximately 0.408% (percentile 34.2). While the numeric probability is modest, a public proof of concept exists, and the project maintainer has not responded to the issue report.

Root Cause

The root cause is missing authorization enforcement in the order cancellation flow. The controller trusts the client-supplied ID argument and invokes the service layer without validating that the authenticated principal — if any — is authorized to act on the referenced order. This is a classic broken access control pattern in which authentication state is not tied to per-resource authorization decisions.

Attack Vector

The attack is performed over the network against the exposed HTTP endpoint. An attacker enumerates or guesses valid order identifiers and submits cancellation requests referencing IDs owned by other users. No credentials or user interaction are required. Refer to the GitHub PoC Repository and the GitHub Issue Discussion for technical detail.

No verified exploit code is reproduced here. See the VulDB CVE-2026-86263 entry for the public disclosure record.

Detection Methods for CVE-2026-86263

Indicators of Compromise

Unexpected cancelOrder requests targeting order IDs that do not correlate with the requesting session or client IP.
Sequential or enumerated ID values submitted to the order cancellation endpoint over a short interval.
Audit log entries showing order state changes to CANCELLED without a matching authenticated user action.

Detection Strategies

Instrument the OrderController.cancelOrder endpoint with structured logging that records the authenticated principal, source IP, and target order owner.
Alert when the principal invoking cancellation does not match the order's owner in the database.
Deploy web application firewall rules to flag anomalous request rates against the cancellation endpoint.

Monitoring Recommendations

Forward application logs to a centralized SIEM and correlate cancellation events with authentication events.
Track baseline cancellation volume per user and alert on statistical deviations.
Review database audit trails for order status transitions initiated outside normal business workflows.

How to Mitigate CVE-2026-86263

Immediate Actions Required

Restrict network exposure of the hosp_order application to trusted networks until a fix is available.
Add server-side authorization checks in cancelOrder that verify the authenticated user owns the referenced order.
Enable request logging on the cancellation endpoint to support incident review.
Monitor the upstream GitHub PoC Repository for a maintainer response and patch commit.

Patch Information

No official patch has been released. The project uses a rolling release model and, according to the disclosure, the maintainer has not yet responded to the issue report. Consumers of the codebase should apply local patches enforcing ownership checks before invoking orderRecordsService.cancelOrder.

Workarounds

Implement a servlet filter or Spring interceptor that validates order ownership against the authenticated session before the request reaches OrderController.cancelOrder.
Require authentication on all /order/* routes and reject requests missing a valid session token.
Use a reverse proxy or API gateway to enforce rate limits and block unauthenticated access to cancellation endpoints.

bash

# Example nginx configuration to restrict access to the cancellation endpoint
location /order/cancel {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://hosp_order_backend;
}