CVE-2026-86263 | sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8 Order Cancellation OrderController.java orderRecordsService.cancelOrder ID authorization (Issue 116)

SecurityVulns
Yanac

A vulnerability, which was classified as critical, was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ID results in authorization bypass.

This vulnerability was named CVE-2026-86263. The attack may be performed from remote. In addition, an exploit is available.

This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More