Is CVE-2026-86263 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86263 being exploited in the wild.

How severe is CVE-2026-86263?

High severity, with a CVSS score of 7.3, published 7 September 2026.

Which products and versions are affected?

Sfturing Hosp Order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.

Is there a fix for CVE-2026-86263?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86263 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86263?

Check whether you run Sfturing Hosp Order at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86263: sfturing hosp_order authorization bypass in order cancellation

CVE-2026-86263 · Severity: high · CVSS 7.3 · Published 2026-09-07

sfturing hosp_order is a hospital appointment scheduling system. An unauthenticated attacker can cancel any patient's appointment by manipulating an order ID parameter, bypassing all authorization checks. This allows unauthorized disruption of medical service scheduling and can trigger cancellation penalties on other patients' accounts.

Technologies: Sfturing Hosp Order. Vendors: Sfturing.

Quick answers

Is CVE-2026-86263 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86263 being exploited in the wild.
How severe is CVE-2026-86263?: High severity, with a CVSS score of 7.3, published 7 September 2026.
Which products and versions are affected?: Sfturing Hosp Order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.
Is there a fix for CVE-2026-86263?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86263 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86263?: Check whether you run Sfturing Hosp Order at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-639: Unverified Ownership) in the OrderController.cancelOrder endpoint (POST /cancelOrder/{id}). The vulnerable component executes the order cancellation immediately via orderRecordsService.cancelOrder(id) before checking if a user exists in the session. No authentication verification or ownership relationship validation occurs—the endpoint processes any numeric ID without verifying the requester's identity or authorization. The attack vector is network-based with no authentication required, no user interaction needed, and no access control preconditions. An attacker can craft a simple HTTP POST request with an arbitrary order ID to cancel any appointment. The project uses a rolling release model and has not yet responded to the early disclosure.

Affected products

sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8

Timeline

2026-07-22: disclosed: Issue reported on GitHub (#116)
2026-09-07: advisory: CVE-2026-86263 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.