CVE-2026-31070

CRITICAL

LalanaChami Pharmacy Management System - Unauthenticated Privilege Escalation via Role Parameter Manipulation

Title source: llm

Description

The LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigning an administrative role during registration. The /api/user/signup endpoint fails to validate the role parameter in the request body

References (2)

Core 2

Core References

https://github.com/LalanaChami/Pharmacy-Mangment-System/blob/5c3d02888631166649856f71d542387114b3010b/backend/routes/user.js#L16

https://gist.github.com/nedlir/22bf6d1a3a07209be3e343744bc81d51

Scores

CVSS v3 9.8

EPSS 0.0048

EPSS Percentile 37.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-269

Status published

Published May 19, 2026

Tracked Since May 19, 2026