sfturing hosp_order CVE-2026-96550

Requires the application to be configured to send email via MailUtil over an unencrypted SMTP connection (no TLS/STARTTLS in the properties returned by getProperties), AND the attacker must hold a network interception (adversary-in-the-middle) position on the path between the app server and the mail server to observe the plaintext. Limiting factors: this is passive-disclosure only (VC:L, no integrity/availability impact), attack complexity is high per the CVSS vector (E:P, 'exploitability difficult'), and the affected product is an obscure hospital-order app with negligible deployment; no code execution or authentication compromise results directly.

This is a low-real-risk issue despite a nominal CVSS 4.0 score of 6.3. The core signals point away from priority: CWE-319 (cleartext transmission) here concerns email/SMTP configuration in MailUtil.getProperties() that omits TLS, and the CVSS vector itself flags AC:H ('the complexity of an attack is rather high') and E:P ('exploitability assessed as difficult'). VulDB describes only VC:L (limited confidentiality impact, no integrity or availability impact). Exploitation requires an adversary-in-the-middle position on the network path to actually capture the plaintext mail traffic, which is why AC:H is appropriate - the raw score is inflated by AV:N/PR:N/UI:N even though the practical bar (network interception) is high. No EPSS score and no CISA KEV listing are present; a public POC exists (VulDB submission referencing GitHub issue #121), but POC availability is NOT the same as active exploitation. There is no vendor fix (rolling-release project, vendor unresponsive). Net: publicly available exploit code exists but no evidence of real-world exploitation, low impact, and a niche affected product - deprioritize versus network-vector RCE/authz flaws.

An attacker positioned on the network path between the hosp_order application server and its SMTP mail server (e.g., shared LAN, compromised router, or hostile transit) passively captures outbound email traffic that MailUtil sends over an unencrypted connection, reading sensitive contents such as notification data or embedded credentials. A public POC referenced via GitHub issue #121 demonstrates the cleartext-transmission condition, but the CVSS vector marks attack complexity high because the attacker must first achieve the interception position.