CVE-2026-96549: sfturing hosp_order Information Disclosure

CVE-2026-96549 Overview

CVE-2026-96549 is a cleartext storage of sensitive information vulnerability [CWE-310] affecting the sfturing hosp_order project up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. The flaw resides in ssm_pro/src/main/java/cn/sfturing/service/impl/CommonUserServiceImpl.java, where sensitive user data is stored without encryption. The project follows a rolling release model, so no fixed version identifiers exist for affected or patched builds. The maintainer was notified through a GitHub issue but has not responded. Exploitation requires local access with low privileges.

Critical Impact
An attacker with local access to the host or database can read sensitive user information stored in cleartext by the CommonUserServiceImpl service.

Affected Products

sfturing hosp_order — all commits up to 627f426331da8086ce8fff2017d65b1ddef384f8
Component: ssm_pro/src/main/java/cn/sfturing/service/impl/CommonUserServiceImpl.java
Distribution model: rolling release (no discrete version identifiers)

Discovery Timeline

2026-09-23 - CVE-2026-96549 published to NVD
2026-09-23 - Last updated in NVD database
Public disclosure via GitHub Issue #120 and VulDB Vulnerability #408951

Technical Details for CVE-2026-96549

Vulnerability Analysis

The vulnerability sits in the CommonUserServiceImpl class of the ssm_pro module. This service handles common user operations, including credential and profile persistence. The implementation writes sensitive information to storage without applying encryption or a strong one-way hash. Any actor with local read access to the underlying data store or filesystem can recover the plaintext values. The advisory maps the weakness to [CWE-310] (Cryptographic Issues), reflecting the absence of protective transformations at rest. Because the project is rolling release, no fixed version boundary exists and all deployments up to the referenced commit remain exposed. See the VulDB CVE record for the full technical writeup.

Root Cause

The service persists sensitive user attributes directly as received, without invoking a cryptographic primitive such as AES for confidentiality or bcrypt/Argon2 for password verification. The absence of a secure storage abstraction in CommonUserServiceImpl allows plaintext to flow into the database or configuration files.

Attack Vector

Exploitation requires local access with authenticated low privileges. An attacker who obtains shell access, a database read grant, or physical access to the storage medium can enumerate the affected records. Remote exploitation over the network is not part of this vulnerability's scope.

No verified exploitation code is published. See the GitHub PoC repository and VulDB CTI reference for community discussion.

Detection Methods for CVE-2026-96549

Indicators of Compromise

Presence of the hosp_order codebase at or before commit 627f426331da8086ce8fff2017d65b1ddef384f8 in production environments
Database columns backing CommonUserServiceImpl containing plaintext credentials or personal data
Backup files, log entries, or exported datasets containing readable user secrets originating from the ssm_pro module

Detection Strategies

Perform static code review of ssm_pro/src/main/java/cn/sfturing/service/impl/CommonUserServiceImpl.java for direct writes of sensitive fields without hashing or encryption calls
Inspect the underlying data store for user records with high-entropy values absent (indicating cleartext) versus expected hash prefixes such as $2a$ for bcrypt
Audit access logs for local users who read the affected tables, files, or backup artifacts

Monitoring Recommendations

Enable database audit logging on the user-account tables written by CommonUserServiceImpl
Monitor filesystem access to application data directories and database export locations on hosts running hosp_order
Track privileged local session activity and anomalous read operations against the affected schema

How to Mitigate CVE-2026-96549

Immediate Actions Required

Restrict local and database access to the hosp_order host to a minimal set of administrators
Rotate all user credentials previously stored by CommonUserServiceImpl and force password resets
Encrypt existing database contents at rest and remove any plaintext backups from shared storage

Patch Information

No vendor patch is available. The maintainer was notified through GitHub Issue #120 and has not responded. Because the project ships as a rolling release, operators must apply source-level fixes: replace plaintext persistence in CommonUserServiceImpl with a strong password hash (Argon2, bcrypt, or scrypt) for authentication data, and with authenticated encryption (for example AES-GCM) for other sensitive fields.

Workarounds

Deploy transparent database encryption (TDE) or full-disk encryption on the storage volume hosting the application data
Move the affected deployment behind a hardened bastion and disable interactive local logins for non-admin accounts
Replace the affected service in a fork with a secure storage implementation until upstream responds

bash

# Configuration example: restrict local access and enforce disk encryption
# 1. Limit shell access on the application host
sudo chown root:appadmin /opt/hosp_order
sudo chmod 750 /opt/hosp_order

# 2. Restrict database reads to the application service account only
REVOKE SELECT ON hosp_order.* FROM 'readonly'@'%';
FLUSH PRIVILEGES;

# 3. Enable at-rest encryption on the data volume (LUKS example)
sudo cryptsetup luksFormat /dev/sdX
sudo cryptsetup open /dev/sdX hosp_data