CVE-2026-31070
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated attackers to escalate privileges by self-assigning an administrative role during registration. The /api/user/signup endpoint does not validate the role parameter.
Risk Assessment
An attacker can gain full administrative access to the pharmacy management system, leading to data theft and manipulation.
Recommendation
Implement role validation on the registration endpoint or restrict registration to trusted users only.
Original NVD description (English source)
The LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigning an administrative role during registration. The /api/user/signup endpoint fails to validate the role parameter in the request body