The vulnerability stems from missing authentication checks on three API endpoints in the LalanaChami Pharmacy Management System, specifically /api/user/getUserData, /api/doctorOder, and associated routes. Unauthenticated remote attackers can issue requests to these endpoints and retrieve a complete dump of all user records, including bcrypt password hashes. They can also modify drug inventory data and access private medical prescription information, effectively compromising both confidentiality and integrity of the system’s sensitive data.

The affected system is the LalanaChami Pharmacy Management System, as demonstrated in the backend/routes code at commit 5c3d028. No specific version numbers are listed beyond this commit, indicating that any release containing these code paths up to and including this commit is vulnerable.

The lack of authentication middleware allows attackers to exploit the endpoints without any prerequisites, making the attack path trivial. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, yet the exposure of full user data, inventory control, and prescription records would represent a high-impact breach. The risk is therefore significant, especially for systems exposed to the public internet or untrusted networks.