CVE-2026-86260: Unverified Password Change in sfturing hosp_order

This vulnerability in sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8 involves the modifyPassWord function in the Password Recovery component (ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java). It allows an attacker to change passwords without verification, enabling unauthorized access. The vulnerability is remotely exploitable without privileges or user interaction. A public exploit is available. Due to the rolling release approach, no explicit version ranges are provided. The vendor has not issued a patch or advisory at this time.

An attacker can remotely change user passwords without verification, potentially leading to unauthorized account access. This undermines authentication controls and could facilitate further compromise of user accounts or sensitive data. The availability of a public exploit increases the risk of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a fix is available, consider restricting access to the affected password recovery functionality or implementing additional verification controls if possible.