Is CVE-2026-96551 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96551 being exploited in the wild.

How severe is CVE-2026-96551?

Medium severity, with a CVSS score of 4.3, published 23 September 2026.

Which products and versions are affected?

Sfturing Hosp Order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.

Is there a fix for CVE-2026-96551?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-96551 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-96551?

Check whether you run Sfturing Hosp Order at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96551: sfturing hosp_order CSRF in user profile modification endpoints

CVE-2026-96551 · Severity: medium · CVSS 4.3 · Published 2026-09-23

The hosp_order hospital appointment system contains multiple cross-site request forgery (CSRF) vulnerabilities in endpoints that modify user profile data. An attacker can craft a malicious webpage that, when visited by a logged-in user, silently changes the victim's phone number, profile identity, gender, or hospital preferences without their knowledge or consent. This could compromise account security and data integrity for hospital patients.

Technologies: Sfturing Hosp Order. Vendors: Sfturing.

Quick answers

Is CVE-2026-96551 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96551 being exploited in the wild.
How severe is CVE-2026-96551?: Medium severity, with a CVSS score of 4.3, published 23 September 2026.
Which products and versions are affected?: Sfturing Hosp Order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.
Is there a fix for CVE-2026-96551?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-96551 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-96551?: Check whether you run Sfturing Hosp Order at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The CommonUserController and HospitalController endpoints (modifiPhone, addUserInfo, updateSex, favourite) lack CSRF token validation and Spring Security configuration. The application processes state-changing POST requests based solely on session authentication without verifying request origin or a CSRF token. An attacker can trigger requests from an arbitrary domain; the victim's browser will automatically include session cookies, allowing unauthorized modifications to user profile data including phone numbers and identity information.

Affected products

sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8

Timeline

2026-07-28: disclosed: Publicly disclosed on GitHub issue #122
2026-09-23: advisory: CVE-2026-96551 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.