CVE Feed

    Dashboard / CVE / CVE-2026-111449

    CVE-2026-111449

    Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.

    Published:Oct 16, 2026
    Last Modified:Oct 26, 2026
    EPS:Oct 16, 2026
    EPSS Score:0.0021
    CVSS Score:5.9

    Affected Products

    Vendor
    Wheels
    Product
    Wheels

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-111450 (CVSS 5.9) — Wheels through 4.1.1 derives its default production error-email address from the Host header of the request th…
    CVE-2026-111448 (CVSS 3.7) — Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive file…
    CVE-2026-111447 (CVSS 8.1) — Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they …
    CVE-2026-111446 (CVSS 8.6) — Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enab…
    CVE-2026-111445 (CVSS 8.1) — Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in fin…
    CVE-2026-111444 (CVSS 9.8) — Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAP…
    CVE-2026-111443 (CVSS 6.5) — Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application co…
    CVE-2026-110911 (CVSS 9.8) — Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High