Wheels Vulnerability in Nested Properties Handling by Wheels Dev
CVE-2026-111447

8.1HIGH

Key Information:

Vendor

Wheels

Status
Wheels
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111447?

The vulnerability allows for manipulation of nested properties in the Wheels framework versions 1.1 through 4.1.2. Specifically, it permits unauthorized users to exploit the 'nestedProperties()' method to update or delete rows associated with another parent record when submitting nested forms. This occurs without adequate checks to ensure that operations pertain solely to the parent being saved. Additionally, it allows the editing of nested 'belongsTo' records by posting a key associated with another record. There exists a further issue with new child rows retaining posted key values, which potentially leads to identity manipulation. Users are advised to upgrade to version 4.2.0 or later to mitigate these risks.

Affected Version(s)

Wheels 1.1.0 < 4.2.0

References

https://github.com/wheels-dev/wheels/security/advisories/...
vendor-advisory

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.