EUVD-2026-30949
GHSA-jhhm-w7f7-gvp5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed pharmacy API
-
DeliverySend unauthenticated GET to /api/user/getUserData
-
ExploitExfiltrate bcrypt hashes and PII
-
ExecutionCall /api/doctorOder for prescription data
-
PersistModify drug inventory via unprotected endpoints
-
ImpactCrack hashes offline for downstream access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of LalanaChami Pharmacy Management System at commit 5c3d028, requiring only network reachability to the backend HTTP API (no user interaction, no credentials, no non-default settings per CVSS AV:N/AC:L/PR:N/UI:N). The only practical limiting factor is deployment scope: this is an unreleased open-source project with no published binaries, so exploitation is bounded to organizations that explicitly cloned and self-hosted this specific commit and exposed its API to the attacker's network path. |
| Impact | Signals are sharply mixed. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N gives a 9.1 critical score driven by network reach, no privileges, and high confidentiality+integrity impact, and a public PoC gist is referenced - both indicate trivial exploitability. However, EPSS sits at 0.06% (17th percentile) and the project is a non-commercial student/personal GitHub repository pinned to a single commit (5c3d028) with no vendor, no release tags, and CPE listed as 'n/a:n/a', meaning real-world install base is almost certainly tiny. It is not on CISA KEV. The realistic priority is therefore high only for any organization that actually deployed this specific codebase; for the broader population it is a low-volume issue despite the critical CVSS. No conflict between CVSS network vector and the description, which clearly describes remote HTTP API access. |
| Exploit ScenarioDerived | An attacker who locates an exposed instance issues an unauthenticated HTTP GET to /api/user/getUserData and receives the full user table including bcrypt password hashes, then cracks weak hashes offline and/or calls /api/doctorOder to read prescription records and modifies drug inventory through other unprotected endpoints. A public PoC gist (nedlir/bc8ad4693c53256819280e8f5de49286) demonstrates the requests, so weaponization requires only a curl command. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 20, 2026
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump all user records including bcrypt password hashes, tamper with drug inventory, and read private medical prescription data. The flaw stems from missing authentication middleware on backend Express routes such as /api/user/getUserData and /api/doctorOder. Publicly available exploit code exists, though EPSS rates exploitation probability at only 0.06% (17th percentile), consistent with a low-deployment open-source project rather than mass exploitation.
RemediationAI
No vendor-released patch identified at time of analysis - the project is an unmaintained GitHub repository with no tagged release. Operators who deployed this codebase should fork it and add authentication middleware (e.g., an Express JWT or session-check middleware) in front of every route in backend/routes, in particular /api/user/getUserData and /api/doctorOder, before exposing the service; until that fix is in place, place the application behind a network restriction such as a VPN or reverse-proxy ACL that requires authenticated access, accepting the trade-off that legitimate remote users will also need that auth layer. Rotate any passwords whose bcrypt hashes may have been exposed and review prescription-data access logs for prior unauthenticated reads. Refer to the upstream advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-31071 and the PoC gist at https://gist.github.com/nedlir/bc8ad4693c53256819280e8f5de49286 for endpoint specifics.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected software is an open-source Node.js/Express pharmacy management backend hosted at github.com/LalanaChami/Pharmacy-Mangment-System. The root cause is CWE-306 (Missing Authentication for a Critical Function): the route definitions under backend/routes do not bind any auth middleware (e.g., JWT verification, session check) in front of sensitive handlers, so the Express router serves them to any caller who can reach the HTTP endpoint. The leaked credential material is bcrypt-hashed but still enables offline cracking against weak passwords, and the prescription endpoint exposes PHI subject to medical-data privacy regimes.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.
Executive ViewAI
The LalanaChami Pharmacy Management System (commit 5c3d028) contains a critical authentication bypass allowing unrestricted remote access to all patient medical records, user credentials with bcrypt hashes, and prescription data without authentication. Publicly available exploit code has been released, and no vendor patch exists, leaving all deployed instances immediately vulnerable. Healthcare organizations using this system face severe regulatory violations, patient privacy breaches, and potential lawsuits absent immediate containment action.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network segmentation restricting system access to authenticated internal networks only via firewall rules; (2) Deploy Web Application Firewall (WAF) to block external requests to /api/user/getUserData and /api/doctorOder; (3) Enable comprehensive API access logging and real-time alerting for endpoint requests; (4) Restrict database backup and export functions; (5) Reset all user passwords immediately; (6) Monitor database query logs for unauthorized data extraction; (7) Consider offline operation until patch is released if patient data exposure cannot be tolerated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB