Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Wheels up to 4.1.2 may let users access others' data

CVE-2026-111445 · published 20 days ago
Summary

Versions 4.0.0 through 4.1.2 of the Wheels software can incorrectly treat a request for a record that belongs to another user or tenant as valid, returning a positive result instead of rejecting it. This can allow a malicious or mistaken user to read, change, or delete data that they should not control. Upgrade to version 4.2.0 or later, where the lookup logic correctly respects ownership and tenant boundaries.

What to do
  • Update wheels wheels to version 4.2.0 or later.
Affected software
VendorProductAffected versions
wheels wheels < 4.2.0
Original advisory text
Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled...
Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or tenant authorization can therefore load and subsequently modify or delete another user's or tenant's record when the key comes from a request. The 4.2.0 fix combines key conditions with incoming scope, query-builder or where conditions in findByKey(), exists(key=), updateByKey() and deleteByKey(). Other scope-aware finders, aggregates, updateAll() and deleteAll() are not affected.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-669Incorrect Resource Transfer Between Spheres
Timeline
Published16 Oct 2026
Updated3 Nov 2026
First seen16 Oct 2026
Sources
CVE-2026-111445 · NVD
CVE-2026-111445 · MITRE
CVE-2026-111445 · OSV
GHSA-2qh9-qcxq-f8qc · GHSA
Track software like this
Free during beta