An unauthenticated authorization bypass vulnerability in sfturing hosp_order allows remote attackers to cancel any patient appointment, posing a significant risk to healthcare scheduling integrity.

The application fails to perform session or ownership validation within the OrderController.java file, allowing unauthenticated remote attackers to invoke the POST /cancelOrder/{id} endpoint and modify appointment statuses.

Successful exploitation allows unauthorized users to disrupt medical services by cancelling appointments on behalf of other patients. This flaw directly impacts operational continuity and could lead to significant administrative burden, potential financial penalties for patients, and damage to the trust and reliability of the healthcare management system. The high severity of this issue is reflected in its CVSS score of 7.3, acknowledging the ease of remote, unauthenticated exploitation.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /cancelOrder/ endpoint at the network or application gateway level to prevent unauthorized requests.

Proactive Monitoring: Review application access logs for unusual spikes in POST requests to the /cancelOrder/ endpoint, particularly those originating from unauthorized or unexpected IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthenticated access to sensitive appointment management endpoints, or enforce session-based authentication requirements at the reverse proxy layer.

Public Exploit Available: Yes, a published proof-of-concept exists (attributed to the researcher's technical write-up linked in the GitHub issue).

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents a credible and immediate risk to system integrity. Security teams should prioritize restricting access to the affected endpoint and maintain close monitoring of logs until the vendor releases a secure update. Immediate mitigation is required to prevent potential service disruption.