The LalanaChami Pharmacy Management System contains a vulnerability in its user registration API endpoint (/api/user/signup) where the role parameter in the request body is not validated. This allows unauthenticated attackers to escalate privileges by self-assigning an administrative role during signup. The vulnerability is documented as CVE-2026-31070. There is no CVSS score or vendor advisory available, and no patch or mitigation details have been provided.

An attacker can gain unauthorized administrative privileges in the LalanaChami Pharmacy Management System by exploiting the lack of validation on the role parameter during user registration. This could lead to full administrative control over the system, potentially compromising sensitive pharmacy management data and operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the user registration endpoint if possible and monitor for suspicious registration activity. Avoid deploying this system in untrusted environments without additional compensating controls.