CVE-2026-86261: sfturing hosp_order Order Controller OrderController.java authorization
A weakness has been identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impacted element is an unknown function of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Controller. Executing a manipulation of the argument userIdenf can lead to authorization bypass. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue is remotely exploitable and requires no privileges or user interaction. An attacker able to reach the affected Order Controller endpoint may be able to manipulate the userIdenf argument to bypass authorization.
Is public exploit code available?
Yes. The available information states that an exploit has been made public and could be used in attacks, increasing the likelihood of exploitation.
Which releases should be considered affected?
The affected code is identified through commit 627f426331da8086ce8fff2017d65b1ddef384f8, but the project uses a rolling release model and affected or fixed version numbers are not available. Deployments containing the specified OrderController.java code should be treated as potentially affected.
What can be done while no vendor fix is available?
The project was notified through an issue report but had not responded at the time of publication. Restrict network access to the Order Controller where possible and apply server-side authorization checks that do not rely on the client-controlled userIdenf argument.