The LalanaChami Pharmacy Management System contains a critical access control vulnerability (CWE-269) in the /api/user/signup endpoint. The endpoint fails to validate the role parameter, allowing unauthenticated attackers to self-assign an administrative role during registration. This results in privilege escalation, granting attackers full administrative control over the system. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting its critical impact with network attack vector, no required privileges or user interaction, and high confidentiality, integrity, and availability impacts.

Successful exploitation allows unauthenticated remote attackers to gain administrative privileges, potentially leading to full system compromise including unauthorized access, modification, and disruption of pharmacy management operations. The vulnerability severely undermines system security by bypassing intended access controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the signup endpoint if possible, and monitor for suspicious registration activity. Do not rely on client-side or superficial validation of role parameters. Implement server-side validation to enforce proper role assignment during user registration.