Wheels Default Email Vulnerability in Versions Prior to 4.1.2

CVE-2026-111450

What is CVE-2026-111450?

The Wheels application version 4.1.1 contains a vulnerability that allows an attacker to manipulate the Host header of the incoming request, potentially leading to the redirection of default error emails to an address controlled by the attacker. If there isn’t a configured error-email recipient and a mail server is enabled that accepts an attacker-specified Host, this could result in the exposure of sensitive error and request metadata in subsequent error messages. In certain configurations, such as on the Lucee 7 engine, the risk of leakage is somewhat mitigated as scope dumps do not render, but attackers may still gain access to valuable configuration secrets and session data. The issue has been addressed in version 4.1.2.

References