CVE-2026-31071 identifies a vulnerability in the LalanaChami Pharmacy Management System where critical API endpoints do not enforce authentication. This flaw permits unauthenticated remote attackers to dump all user records, including bcrypt password hashes, alter drug inventory data, and access confidential medical prescription details. The vulnerability arises from missing authentication middleware on the affected API routes. There is no CVSS score or vendor advisory indicating remediation status.

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive user information, including password hashes, unauthorized modification of pharmaceutical inventory data, and exposure of private medical prescriptions. This compromises user privacy, data integrity, and potentially patient safety. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints through network controls or implement custom authentication mechanisms to prevent unauthorized access.