CVE-2026-31071

API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware

Critical · published May 19, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
50.5
In the wild
Unconfirmed
What it is

API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00651 · 50.5th percentile
Published
2026-05-19T00:00Z
EPSS history
Timeline
  • 19 MAY 00:00Z
    API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware
    cvelistv5