Is CVE-2026-86261 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86261 being exploited in the wild.

How severe is CVE-2026-86261?

High severity, with a CVSS score of 7.3, published 7 September 2026.

Which products and versions are affected?

Sfturing Hosp Order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.

Is there a fix for CVE-2026-86261?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86261 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86261?

Check whether you run Sfturing Hosp Order at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86261: sfturing hosp_order authorization bypass in Order Controller

CVE-2026-86261 · Severity: high · CVSS 7.3 · Published 2026-09-07

sfturing hosp_order is a hospital appointment booking system used by healthcare facilities. An unauthenticated attacker can create appointments on behalf of any patient and retrieve their sensitive personal information (identity number, phone, email, name, sex) by simply submitting a POST request with a known patient ID. This allows attackers to impersonate patients, book fraudulent appointments, and steal patient data without any authentication.

Technologies: Sfturing Hosp Order. Vendors: Sfturing.

Quick answers

Is CVE-2026-86261 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86261 being exploited in the wild.
How severe is CVE-2026-86261?: High severity, with a CVSS score of 7.3, published 7 September 2026.
Which products and versions are affected?: Sfturing Hosp Order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.
Is there a fix for CVE-2026-86261?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86261 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86261?: Check whether you run Sfturing Hosp Order at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-862) in the Order Controller's POST /order endpoint. The vulnerable code at OrderController.java:61-89 trusts a caller-controlled userIdenf request parameter to select which user account to create an appointment for, without verifying that the authenticated subject (if any) owns that account. No session validation, authentication check, or ownership verification exists. An attacker can craft a POST request with an arbitrary userIdenf value to create orders under any patient ID and receive that patient's PII in the response, which is then exposed in the rendered orderInfo.jsp page. The endpoint is network-accessible and requires no authentication or special privileges. No patch has been released as the project maintainers have not responded to the issue report.

Affected products

sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8

Timeline

2026-07-22: disclosed: Issue opened on GitHub
2026-09-07: advisory: CVE-2026-86261 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.