Is CVE-2026-86262 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86262 being exploited in the wild.

How severe is CVE-2026-86262?

High severity, with a CVSS score of 7.3, published 7 September 2026.

Which products and versions are affected?

Sfturing Hosp Order up to 627f426331da8086ce8fff2017d65b1ddef384f8.

Is there a fix for CVE-2026-86262?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86262 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86262?

Check whether you run Sfturing Hosp Order at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86262: sfturing hosp_order authorization bypass in Order Handler

CVE-2026-86262 · Severity: high · CVSS 7.3 · Published 2026-09-07

sfturing hosp_order is a hospital appointment scheduling system. The application fails to verify user identity when processing appointment modifications, allowing unauthenticated attackers to alter other users' appointments, change medical information, and access sensitive health-related appointment data without permission.

Technologies: Sfturing Hosp Order. Vendors: Sfturing.

Quick answers

Is CVE-2026-86262 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86262 being exploited in the wild.
How severe is CVE-2026-86262?: High severity, with a CVSS score of 7.3, published 7 September 2026.
Which products and versions are affected?: Sfturing Hosp Order up to 627f426331da8086ce8fff2017d65b1ddef384f8.
Is there a fix for CVE-2026-86262?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86262 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86262?: Check whether you run Sfturing Hosp Order at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication and authorization bypass (CWE-639) in the OrderController's updateOrderSta1 and updateOrderdiseaseInfo functions. The vulnerable code accepts userID and order ID parameters directly from unauthenticated POST requests to /orderUserCenter and performs database updates without validating that the current user owns the target appointment. The MyBatis queries use only WHERE id = #{id}, binding neither the authenticated user nor checking ownership before updating state or disease information. An unauthenticated attacker can craft HTTP POST requests with arbitrary userID and order ID values to modify appointments and retrieve another user's appointment metadata. No patch is currently available; the project maintainers have not responded to the early disclosure.

Affected products

sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8

Timeline

2026-07-22: disclosed: Vulnerability reported via GitHub issue #115
2026-09-07: advisory: CVE-2026-86262 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.