CVE-2026-86263: sfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorization
A vulnerability was detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ID results in authorization bypass. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or user interaction?
No. The reported vector indicates network-accessible exploitation with no privileges or user interaction required.
Is exploit code available publicly?
Yes. The vulnerability report states that a public exploit is available and may be used.
Is there a confirmed fixed release to deploy?
No specific affected or updated version is disclosed because the project uses rolling releases. The project was reportedly notified through an issue report but had not responded at the time of reporting.