CVE-2026-3023 is a NoSQL injection vulnerability identified in the Wakyma web application affecting all versions. The flaw exists in the 'vets.wakyma.com/pets/print-tags' endpoint, where the application fails to properly neutralize special elements in data query logic, classified under CWE-943. This improper sanitization allows an authenticated user to craft malicious POST requests that inject NoSQL commands into the backend database queries. As a result, attackers can retrieve unauthorized data, specifically listing pets and their owners, thereby compromising data confidentiality. The vulnerability requires authentication but no additional user interaction, and the attack complexity is low, meaning a legitimate user with minimal privileges can exploit it. The CVSS 4.0 vector indicates a network attack vector, low complexity, no privilege escalation beyond authentication, and no user interaction, with a score of 5.3 (medium severity). No patches or known exploits are currently available, but the vulnerability represents a significant risk to organizations relying on Wakyma for pet and veterinary management. The root cause is the failure to sanitize or parameterize NoSQL queries properly, allowing injection of special query elements that alter the intended logic. This type of injection can lead to unauthorized data disclosure and potentially further exploitation if combined with other vulnerabilities.

The primary impact of this vulnerability is unauthorized disclosure of sensitive data, including pet and owner information, which can lead to privacy violations and potential regulatory non-compliance (e.g., GDPR). For veterinary clinics and pet management services using Wakyma, this could damage customer trust and brand reputation. Since the vulnerability requires authentication but no elevated privileges, insider threats or compromised user accounts could exploit it to escalate data access beyond their authorization. Although the vulnerability does not directly affect system integrity or availability, the exposure of confidential data may facilitate further attacks or social engineering. Organizations worldwide that use Wakyma or similar veterinary management platforms are at risk, especially those with large databases of personal and pet-related information. The medium severity score reflects moderate risk, but the ease of exploitation and sensitive nature of the data involved make it a significant concern for affected entities.

1. Implement strict input validation and sanitization on all user-supplied data sent to the 'print-tags' endpoint, ensuring special NoSQL query elements are neutralized. 2. Use parameterized queries or prepared statements for all database interactions to prevent injection attacks. 3. Restrict access to the vulnerable endpoint to only necessary authenticated roles and enforce least privilege principles. 4. Monitor logs for unusual query patterns or repeated failed attempts that may indicate exploitation attempts. 5. Conduct regular security assessments and code reviews focusing on injection vulnerabilities in NoSQL queries. 6. If possible, isolate the database with network segmentation and apply strict access controls to limit the blast radius of any exploitation. 7. Educate developers and security teams about NoSQL injection risks and secure coding practices specific to NoSQL databases. 8. Stay alert for official patches or updates from Wakyma and apply them promptly once available.