Authorization Bypass in sfturing hosp_order Order Cancellation Component

CVE-2026-86263

What is CVE-2026-86263?

A significant vulnerability has been identified in the sfturing hosp_order application which affects the order cancellation functionality. The issue arises in the method orderRecordsService.cancelOrder located in the OrderController.java file. By manipulating the argument ID, an unauthorized actor can bypass the intended authorization checks, allowing for remote exploitation of the system. This flaw poses a serious threat as the exploit has been publicly documented and can be easily leveraged by malicious entities. Despite early notification of the problem from users, the project maintainers have yet to address this critical issue, leaving users at risk.

References