Executive brief
sfturing hosp_order is a hospital appointment booking system used by healthcare facilities. An unauthenticated attacker can create appointments on behalf of any patient and retrieve their sensitive personal information (identity number, phone, email, name, sex) by simply submitting a POST request with a known patient ID. This allows attackers to impersonate patients, book fraudulent appointments, and steal patient data without any authentication.
Technical details
The vulnerability is an authorization bypass (CWE-862) in the Order Controller's POST /order endpoint. The vulnerable code at OrderController.java:61-89 trusts a caller-controlled userIdenf request parameter to select which user account to create an appointment for, without verifying that the authenticated subject (if any) owns that account. No session validation, authentication check, or ownership verification exists. An attacker can craft a POST request with an arbitrary userIdenf value to create orders under any patient ID and receive that patient's PII in the response, which is then exposed in the rendered orderInfo.jsp page. The endpoint is network-accessible and requires no authentication or special privileges. No patch has been released as the project maintainers have not responded to the issue report.
Affected products
- sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8
Timeline
- 2026-07-22: disclosed: Issue opened on GitHub
- 2026-09-07: advisory: CVE-2026-86261 published