CVE-2026-54569 affects SENAITE.CORE versions 2.0.0 through 2.6.0, a laboratory information management system framework. The vulnerability allows unauthenticated remote code execution via a two-request attack chain. State-changing JSON API routes in update.py fail to enforce the required 'senaite.core: Access JSON API' permission, allowing anonymous object resolution. Additionally, set_fields_from_request in init.py passes raw user input for RecordsField and RecordField instances directly to eval() before any write-permission checks occur. An attacker can discover the bika_setup object via @@uuid, then send crafted payloads to /@@API/update to execute arbitrary Python code in the Zope worker. The same unsafe eval pattern exists in record.py and records.py within senaite.core browser fields. Successful exploitation can lead to data exposure or modification, account compromise, file access, and service disruption.