EUVD-2026-30945
GHSA-qg5w-7c3j-rfjc
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
The LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigning an administrative role during registration. The /api/user/signup endpoint fails to validate the role parameter in the request body
AnalysisAI
Privilege escalation in LalanaChami Pharmacy Management System (commit 5c3d028) allows any remote unauthenticated attacker to register a new account with administrator privileges by simply including a role parameter in the signup request body. The /api/user/signup endpoint trusts client-supplied role values without server-side validation, granting full administrative access in a single HTTP call. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: disable the /api/user/signup endpoint or implement mandatory server-side role validation rejecting all client-supplied role parameters; audit all user accounts created in the past 30 days for unauthorized administrative privileges. Within 7 days: contact LalanaChami for emergency guidance; review API access logs for exploitation attempts and suspicious account creation patterns. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today