Information Disclosure in Wheels Framework by Wheels
CVE-2026-111449

5.9MEDIUM

Key Information:

Vendor

Wheels

Status
Wheels
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111449?

The Wheels Framework versions 3.0.0 through 4.1.1 contain a vulnerability that can expose sensitive error handling information to unauthorized clients. When the 'allowIPBasedDebugAccess' setting is enabled, an administrator can inadvertently expose detailed exception data, including sensitive context and serialized exception information, during error handling. This situation could arise if an unauthorized user's request coincidentally triggers an error while an admin is adjusting debug settings. This exposure does not bypass existing protections for production environments that guard developer tools, but it emphasizes the importance of appropriately configuring access settings. The vulnerability has been addressed and resolved in version 4.1.2.

Affected Version(s)

Wheels 3.0.0 < 4.1.2

References

https://github.com/wheels-dev/wheels/security/advisories/...
vendor-advisory

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.