API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 19, 2026 · NIST NVD

   Detected

   API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.

2. Jul 24, 2026 · NIST NVD

   Updated

   API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.

Sources

• CVE.orgVulnerability recordCVE-2026-31071

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-31071

  API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access priv

  nvd.nist.gov

References

• Reference · gist.github.com
• Reference · github.com