CVE-2026-111447: Wheels framework authorization bypass in nested properties

CVE-2026-111447 · Severity: high · CVSS 8.1 · Published 2026-10-16

Wheels is a web application framework that simplifies handling of related database records through nested forms. An attacker who can submit a form for their own parent record can exploit insufficient access checks to read, modify, or delete another user's related records, or reassign them to their own account. This allows unauthorized data manipulation and potential account takeover of associated information.

Technologies: Wheels. Vendors: Wheels.

Quick answers

Is CVE-2026-111447 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111447 being exploited in the wild.
How severe is CVE-2026-111447?
High severity, with a CVSS score of 8.1, published 16 October 2026.
Which products and versions are affected?
Wheels 1.1 through 4.1.2.
Is there a fix for CVE-2026-111447?
Yes: fixed in 4.2.0. Until then: Do not use allowDelete=true on nested associations whose child keys come from untrusted input. Before saving, verify in the controller that every posted nested child key belongs to the parent being edited, or rebuild the nested structure server-side from the parent's own children. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111447 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-111447?
Check whether you run Wheels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 4.2.0

Do not use allowDelete=true on nested associations whose child keys come from untrusted input. Before saving, verify in the controller that every posted nested child key belongs to the parent being edited, or rebuild the nested structure server-side from the parent's own children.

Technical details

The nestedProperties() function resolves associated records by posted primary key without verifying they belong to the parent being saved. An authenticated user can post foreign key values from another user's records in a nested form; the framework will fetch, modify, and reassign those records to the attacker's parent. Composite primary keys that are not foreign keys can also be controlled by the attacker when creating new child rows. This is fixed in version 4.2.0 by scoping nested record lookups to the parent's persisted key and clearing posted primary-key values on new rows.

Affected products

  • Wheels Wheels 1.1 through 4.1.2

Timeline

  • 2026-10-12: advisory
  • 2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.