What is the CVSS score of CVE-2026-31071?

CVE-2026-31071 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Pharmacy Management System are affected by CVE-2026-31071?

The LalanaChami Pharmacy Management System (commit 5c3d028) contains a critical authentication bypass allowing unrestricted remote access to all patient medical records, user credentials with bcrypt…

Is there a public PoC exploit available for CVE-2026-31071?

Yes, a public proof-of-concept exploit is available for CVE-2026-31071. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-31071?

WITHIN 24 HOURS: Isolate LalanaChami instances from external networks or take offline; audit logs for API calls to /api/user/getUserData and /api/doctorOder endpoints for past 90 days; notify incident response, legal, and healthcare compliance teams. WITHIN 7 DAYS: Complete forensic analysis to determine scope of unauthorized access; reset all system user credentials; escalate to LalanaChami vendor for patch timeline and workaround options. WITHIN 30 DAYS: Upon vendor patch availability, validate in isolated test environment and deploy; if vendor abandons product, execute migration plan to alternative pharmacy management system; assess exposed patient data scope and initiate HIPAA/healthcare privacy law breach notification procedures.

Pharmacy Management System CVE-2026-31071

EUVD-2026-30949 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-05-19 mitre

GHSA-jhhm-w7f7-gvp5

Authentication Bypass N A

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 14:23 vuln.today

CVSS changed

May 20, 2026 - 14:22 NVD

9.1 (CRITICAL)

CVE Published

May 19, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.

AnalysisAI

Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump all user records including bcrypt password hashes, tamper with drug inventory, and read private medical prescription data. The flaw stems from missing authentication middleware on backend Express routes such as /api/user/getUserData and /api/doctorOder. Publicly available exploit code exists, though EPSS rates exploitation probability at only 0.06% (17th percentile), consistent with a low-deployment open-source project rather than mass exploitation.

Technical ContextAI

The affected software is an open-source Node.js/Express pharmacy management backend hosted at github.com/LalanaChami/Pharmacy-Mangment-System. The root cause is CWE-306 (Missing Authentication for a Critical Function): the route definitions under backend/routes do not bind any auth middleware (e.g., JWT verification, session check) in front of sensitive handlers, so the Express router serves them to any caller who can reach the HTTP endpoint. The leaked credential material is bcrypt-hashed but still enables offline cracking against weak passwords, and the prescription endpoint exposes PHI subject to medical-data privacy regimes.

RemediationAI

No vendor-released patch identified at time of analysis - the project is an unmaintained GitHub repository with no tagged release. Operators who deployed this codebase should fork it and add authentication middleware (e.g., an Express JWT or session-check middleware) in front of every route in backend/routes, in particular /api/user/getUserData and /api/doctorOder, before exposing the service; until that fix is in place, place the application behind a network restriction such as a VPN or reverse-proxy ACL that requires authenticated access, accepting the trade-off that legitimate remote users will also need that auth layer. Rotate any passwords whose bcrypt hashes may have been exposed and review prescription-data access logs for prior unauthenticated reads. Refer to the upstream advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-31071 and the PoC gist at https://gist.github.com/nedlir/bc8ad4693c53256819280e8f5de49286 for endpoint specifics.