CVE-2026-86262: Authorization Bypass in sfturing hosp_order

This vulnerability in sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8 allows an attacker to bypass authorization controls by manipulating the userID/id arguments in the updateOrderSta1 and updateOrderdiseaseInfo functions within OrderController.java. The flaw enables remote attackers to perform unauthorized actions on order data. The product's rolling release strategy prevents specifying exact affected versions. The vulnerability was disclosed publicly and may be exploited, but no known exploits are currently reported in the wild. The vendor has not yet responded or issued a fix.

An attacker can remotely bypass authorization checks in the affected functions, potentially allowing unauthorized modification of order status or disease information. This could lead to unauthorized data changes within the Order Handler component. The vulnerability does not require privileges or user interaction to exploit, increasing its risk. However, the CVSS score indicates a medium severity impact with low complexity and no requirement for authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a fix is available, consider restricting access to the affected functions or implementing additional access controls at the application or network level to mitigate unauthorized access risks.