CVE-2026-86260 sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password change
Attackers can remotely change user passwords without verification in the sfturing hosp_order system, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86260?
CVE-2026-86260 is a medium-severity authentication bypass vulnerability in sfturing hosp_order, published on 7 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security flaw has been discovered in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function modifyPassWord of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java of the component Password Recovery. Performing a manipulation results in unverified password change. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Which versions are affected by CVE-2026-86260?
How do I fix CVE-2026-86260?
No fix has been published for CVE-2026-86260 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-86260 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86260 exists.
Sources
Also known as GHSA-4vjm-63qv-6fj7.