Authorization Bypass in Wheels Product by Wheels Dev

CVE-2026-111445

What is CVE-2026-111445?

Wheels versions 4.0.0 to 4.1.2 have a significant security flaw that allows an attacker to bypass authorization checks. When utilizing the 'findByKey()' and 'exists(key=)' methods, the system replaces incoming scope conditions with a primary key condition, which may return true for invalid keys. Consequently, applications using scopes for tenant authorization could inadvertently allow one user to access and manipulate another's records. The vulnerability is resolved in version 4.2.0, where the fix integrates incoming scope with key conditions, thus enhancing the security of tenant data and protecting against unauthorized alterations.

References