The vulnerability resides in the updateOrderSta1 and updateOrderdiseaseInfo functions of OrderController, where the userID or id argument can be manipulated to bypass the ownership check. This oversight allows an attacker to modify the status or disease information of any order that they do not own, violating confidentiality and integrity of patient records. The weakness follows CWE‑285 and CWE‑639 guidelines.

The affected application is sfturing’s hosp_order, specifically the OrderHandler module located in ssm_pro/src/main/java/cn/sfturing/web/OrderController.java. Any release prior to commit 627f4263 is potentially affected, and versions cannot be enumerated precisely because the project follows a rolling‑release model. No official vendor patch is available at this time.

The CVSS score of 6.9 indicates a moderate severity and the exploit can be carried out remotely via crafted HTTP requests that set a forged userID/id. The vulnerability is publicly disclosed, but its EPSS score is unavailable, and it has not yet been catalogued in the CISA KEV list. Attackers do not require authentication to the application to perform the bypass, making exploitation potentially easier.