hosp_order CVE-2026-86263

The vulnerable endpoint is the cancelOrder handler in OrderController.java, reachable over the network via HTTP/HTTPS. The CVSS 4.0 provided vector specifies PR:N (no privileges required), suggesting the endpoint may require no authentication; however, this is atypical for IDOR and should be confirmed by reviewing the application's authentication filter chain - if a user session is required, exploitation is limited to any authenticated user. The attacker must supply a valid order ID for a target record; sequential integer IDs used by typical Java/MyBatis applications are easily enumerable by incrementing or decrementing from a known value. No special OS, platform, or non-default configuration is required. Exploitation is constrained to order cancellation only - it does not provide shell access, credential disclosure, or arbitrary data modification beyond the cancellation action.

The provided CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects low attack complexity and no privilege requirement, implying the cancellation endpoint may be reachable without any authentication - this should be independently verified against the source code, as PR:N is atypical for IDOR which usually presupposes at least a low-privilege user session. A public exploit exists (E:P in the CVSS 4.0 environmental component, corroborated by GitHub issue #116), lowering the exploitation bar significantly. KEV listing is absent and EPSS data is not provided, so no confirmed active exploitation is known at time of analysis. Despite a moderate base score, the contextual risk in a healthcare deployment is amplified: unauthorized cancellation of hospital orders (prescriptions, lab tests, procedures) carries patient safety consequences well beyond a typical integrity violation on generic application data. The rolling release model with no vendor response means no patched commit is available to target for remediation.

An attacker with network access to the application - potentially without any login if the endpoint is truly unauthenticated - submits an HTTP request to the order cancellation endpoint, substituting an order ID belonging to a different patient. Because the server calls cancelOrder without verifying ownership, the target order is silently cancelled. The technique is documented in the public GitHub issue #116, making this accessible to low-skill actors.