EUVD-2026-30949
GHSA-jhhm-w7f7-gvp5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.
AnalysisAI
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump all user records including bcrypt password hashes, tamper with drug inventory, and read private medical prescription data. The flaw stems from missing authentication middleware on backend Express routes such as /api/user/getUserData and /api/doctorOder. Publicly available exploit code exists, though EPSS rates exploitation probability at only 0.06% (17th percentile), consistent with a low-deployment open-source project rather than mass exploitation.
Technical ContextAI
The affected software is an open-source Node.js/Express pharmacy management backend hosted at github.com/LalanaChami/Pharmacy-Mangment-System. The root cause is CWE-306 (Missing Authentication for a Critical Function): the route definitions under backend/routes do not bind any auth middleware (e.g., JWT verification, session check) in front of sensitive handlers, so the Express router serves them to any caller who can reach the HTTP endpoint. The leaked credential material is bcrypt-hashed but still enables offline cracking against weak passwords, and the prescription endpoint exposes PHI subject to medical-data privacy regimes.
RemediationAI
No vendor-released patch identified at time of analysis - the project is an unmaintained GitHub repository with no tagged release. Operators who deployed this codebase should fork it and add authentication middleware (e.g., an Express JWT or session-check middleware) in front of every route in backend/routes, in particular /api/user/getUserData and /api/doctorOder, before exposing the service; until that fix is in place, place the application behind a network restriction such as a VPN or reverse-proxy ACL that requires authenticated access, accepting the trade-off that legitimate remote users will also need that auth layer. Rotate any passwords whose bcrypt hashes may have been exposed and review prescription-data access logs for prior unauthenticated reads. Refer to the upstream advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-31071 and the PoC gist at https://gist.github.com/nedlir/bc8ad4693c53256819280e8f5de49286 for endpoint specifics.
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configuratio
SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via t
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Privilege escalation via broken access control in Citrix Cloud (through 2025-11-10) lets a user holding only read-only p
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() retu
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today