A vulnerability exists in sfturing hosp_order that allows an attacker to manipulate the order ID passed to the cancelOrder method in OrderController.java, bypassing the normal authorization checks. This results in the ability to cancel any order without proper privileges. The flaw is exploitable remotely, as the API is exposed to clients over HTTP and the exploit is publicly documented. The impact is a loss of integrity for order records.

The affected product is sfturing hosp_order, a web application for hospital order management. Because the project uses a rolling release model, specific version numbers are not published, but any release built before the merge of commit 627f426331da8086ce8fff2017d65b1ddef384f8 is vulnerable.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not a known widely‑used exploit. Nevertheless, the ability to bypass authorization with a simple crafted request makes the vulnerability practical for attackers, especially if the application is exposed to the internet. The risk is moderate to high depending on the sensitivity of the orders being managed.