CVE-2026-86263: Authorization Bypass in sfturing hosp_order

This vulnerability exists in the orderRecordsService.cancelOrder function within the OrderController.java file of the sfturing hosp_order component. By manipulating the ID argument, an attacker can bypass authorization controls to cancel orders without proper permissions. The vulnerability can be exploited remotely without authentication or user interaction. The product's rolling release model means no fixed version numbers are provided for affected or fixed releases. The issue was reported early to the project but remains unaddressed, and public exploit code is available.

An attacker can remotely bypass authorization checks to cancel orders they are not authorized to cancel. This could lead to unauthorized order cancellations, potentially disrupting service or causing operational issues. The vulnerability does not require privileges or user interaction, increasing its risk. The CVSS 4.0 score of 6.9 reflects a medium severity impact with low attack complexity but limited scope and impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are provided, users should monitor for official updates. Until a fix is available, consider implementing additional access controls or monitoring around order cancellation functionality to detect unauthorized attempts.