sfturing hosp_order CVE-2026-96549

Requires local access to the host running sfturing hosp_order with at least a low-privilege authenticated account (CVSS AV:L, PR:L), no user interaction. The sensitive data is exposed because CommonUserServiceImpl.java stores it in cleartext (CWE-312) rather than encrypting or hashing it. Exploitation is limited by the local-only vector - there is no remote/network path - and by the app's rarity; there is no fixed release available since the project ships rolling releases and has not responded to the report.

This is a genuinely low-priority issue and the signals are internally consistent. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N, VC:L only, no integrity or availability impact) scores just 1.9, reflecting that an attacker must already have local, authenticated (low-privilege) access to the host to read sensitive data stored in cleartext in CommonUserServiceImpl.java. No EPSS score is provided and there is no CISA KEV listing, so there is no evidence of active or automated exploitation. A public exploit does exist - the flaw was disclosed via GitHub issue #120 and cataloged by VulDB (408951) - but POC availability is not the same as exploitation in the wild, and the local-only attack vector plus low technical impact (single confidentiality leak, no privilege escalation) make weaponization unattractive. The SSVC-style read is: exploitation=public POC, not automatable (requires prior local access), technical impact=partial/low. Real risk is minimal outside of an already-compromised or multi-user host. Note the affected boundary is imprecise: the project uses rolling releases so no fixed version exists, and the vendor has not responded to the report.

An attacker who already has a low-privilege local account (or has otherwise gained a foothold) on the host running the hosp_order application reads sensitive data (e.g., credentials or user information) that the CommonUserService persists or logs in cleartext. A public POC exists in the project's GitHub issue tracker (#120), but exploitation yields only disclosure of that stored data - no code execution or privilege gain.