CVE-2026-31071

Published: May 19, 2026Modified: Jul 24, 2026Deferred

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (3)

https://gist.github.com/nedlir/bc8ad4693c53256819280e8f5de49286

Source: cve@mitre.org

https://github.com/LalanaChami/Pharmacy-Mangment-System/tree/5c3d02888631166649856f71d542387114b3010b/backend/routes

Source: cve@mitre.org

https://gist.github.com/nedlir/bc8ad4693c53256819280e8f5de49286

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.