CVE-2026-31071
The LalanaChami Pharmacy Management System has a critical flaw: its API endpoints do not require authentication. This allows anyone on the network to read all user data, change drug inventory, and view private prescriptions.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
LalanaChami Pharmacy Management System (commit 5c3d028). No specific version numbers are listed.
Real-world impact
An attacker who can reach the API can dump every user record—including encrypted passwords—alter the drug inventory, and read confidential prescription information.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is exploitable over the network, requires no user interaction, and grants the attacker full confidentiality and integrity access to sensitive data.
What to do about it
- ›Restrict network access to the API endpoints so only trusted systems can reach them.
- ›Disable or secure the vulnerable endpoints until a patch is available.
- ›Monitor API logs for suspicious activity and investigate any unauthorized requests.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description
Timeline
- May 19, 2026 · May 19, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.