CVE-2026-96551 identifies a CSRF vulnerability in the sfturing hosp_order project, specifically within an unknown function in the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. This vulnerability allows remote attackers to perform unauthorized request manipulations. The project lacks versioning, so precise affected versions cannot be determined. The vulnerability has been publicly disclosed, but no patch or remediation has been provided by the maintainers as of the publication date.

The vulnerability enables remote attackers to perform cross-site request forgery attacks, potentially causing unintended actions on behalf of authenticated users. The impact is limited to integrity loss without confidentiality or availability impact, reflected by a CVSS score of 4.3 (low severity). No known exploits are currently active in the wild.

No official fix or patch is currently available, and the project maintainers have not responded to the issue report. Users should monitor the project for updates and consider implementing CSRF protections at the application or infrastructure level as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory or project repository for current remediation guidance.