Unauthenticated remote attackers can create an account that claims administrative authority by supplying a privileged role during the signup process. The /api/user/signup endpoint does not verify the role field, allowing an attacker to assign an administrator role without prior authentication. This flaw is a classic privilege escalation weakness and is consistent with identified weaknesses in privilege control and authorization.

The vulnerability exists in LalanaChami Pharmacy Management System, affecting any deployment running commit 5c3d028 or earlier before the patch. All instances that expose the signup API to the public internet are susceptible, regardless of other security controls.

An attacker can send a simple HTTP POST request to the public signup route, embed an administrative role value, and register successfully. No authentication or special credentials are required, making the attack trivial and automated. The CVSS score of 9.8 denotes severe impact, but the EPSS score below 1% indicates a relatively low likelihood of exploitation in the field. The vulnerability is not currently listed in the CISA KEV catalog, yet the potential for uncontrolled administrative access remains high.