CVE-2026-96550 describes a vulnerability in the sfturing hosp_order codebase up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. The issue is located in the getProperties function of the file ssm_pro/src/main/java/cn/sfturing/utils/MailUtil.java. Manipulating this function can cause sensitive information to be transmitted in cleartext over the network. The attack can be initiated remotely but requires high complexity and is difficult to exploit. Although the exploit has been publicly disclosed, no known active exploitation has been reported. The project uses continuous delivery with rolling releases, so no discrete version numbers for affected or patched releases are available. The project maintainers have been notified but have not yet issued a response or patch.

The vulnerability allows remote attackers to cause sensitive information to be transmitted in cleartext, potentially exposing it to interception. However, the impact is limited to confidentiality (low impact), with no integrity or availability effects. The attack complexity is high and exploitability is difficult, reducing the likelihood of successful exploitation. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project uses continuous delivery with rolling releases and has not responded yet, monitor for updates or patches from the maintainers. Until a fix is available, consider network-level protections to prevent interception of sensitive data transmitted by this component.