# CVE-2026-96551: sfturing hosp_order CSRF in user profile modification endpoints

Source: https://junglewise.ai/threats/cve-2026-96551-a-vulnerability-was-determined-in-sfturing-hosp-order-up-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-96551 · Severity: medium · CVSS 4.3 · Published 2026-09-23

The hosp_order hospital appointment system contains multiple cross-site request forgery (CSRF) vulnerabilities in endpoints that modify user profile data. An attacker can craft a malicious webpage that, when visited by a logged-in user, silently changes the victim's phone number, profile identity, gender, or hospital preferences without their knowledge or consent. This could compromise account security and data integrity for hospital patients.

Technologies: [Sfturing Hosp Order](https://junglewise.ai/threats/technologies/hosp-order). Vendors: [Sfturing](https://junglewise.ai/threats/vendors/sfturing).

## Quick answers

**Is CVE-2026-96551 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96551 being exploited in the wild.

**How severe is CVE-2026-96551?** Medium severity, with a CVSS score of 4.3, published 23 September 2026.

**Which products and versions are affected?** Sfturing Hosp Order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.

**Is there a fix for CVE-2026-96551?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-96551 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-96551?** Check whether you run Sfturing Hosp Order at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The CommonUserController and HospitalController endpoints (modifiPhone, addUserInfo, updateSex, favourite) lack CSRF token validation and Spring Security configuration. The application processes state-changing POST requests based solely on session authentication without verifying request origin or a CSRF token. An attacker can trigger requests from an arbitrary domain; the victim's browser will automatically include session cookies, allowing unauthorized modifications to user profile data including phone numbers and identity information.

## Affected products

- sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8

## Timeline

- 2026-07-28: disclosed: Publicly disclosed on GitHub issue #122
- 2026-09-23: advisory: CVE-2026-96551 published on NVD

## References

- [https://github.com/sfturing/hosp_order/](https://github.com/sfturing/hosp_order/)
- [https://github.com/sfturing/hosp_order/issues/122](https://github.com/sfturing/hosp_order/issues/122)

## Related threats

- [sfturing hosp_order hard-coded credentials in configuration](https://junglewise.ai/threats/cve-2026-96548-a-flaw-has-been-found-in-sfturing-hosp-order-up-to)
- [sfturing hosp_order reflected XSS in public search parameters](https://junglewise.ai/threats/cve-2026-95396-a-vulnerability-was-identified-in-sfturing-hosp-order-up-to)
- [sfturing hosp_order authorization bypass in order cancellation](https://junglewise.ai/threats/cve-2026-86263-sfturing-hosp-order-authorization-bypass-in-order-cancellation)
- [sfturing hosp_order authorization bypass in Order Handler](https://junglewise.ai/threats/cve-2026-86262-sfturing-hosp-order-authorization-bypass-in-order-handler)
- [sfturing hosp_order authorization bypass in Order Controller](https://junglewise.ai/threats/cve-2026-86261-sfturing-hosp-order-authorization-bypass-in-order-controller)