CVE-2026-111445
Received Received - Intake

Authentication Bypass in Wheels Framework 4.0.0-4.1.2

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: MITRE

Description
Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or tenant authorization can therefore load and subsequently modify or delete another user's or tenant's record when the key comes from a request. The 4.2.0 fix combines key conditions with incoming scope, query-builder or where conditions in findByKey(), exists(key=), updateByKey() and deleteByKey(). Other scope-aware finders, aggregates, updateAll() and deleteAll() are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111445
EUVD
EUVD-2026-102607

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wheels Wheels 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-669 The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Wheels framework versions 4.0.0 to 4.1.2. It involves the findByKey() and exists(key=) methods ignoring scope chains used for authorization or multi-tenancy. This allows bypassing access controls, potentially letting users access records outside their intended scope.

Detection Guidance

Check Wheels framework version with command: grep -r 'Wheels' /path/to/your/project | grep 'version'. If version is between 4.0.0 and 4.1.2, the system is vulnerable. Review code for use of findByKey() or exists(key=) methods in user input handling paths.

Impact Analysis

An attacker could exploit this to load, update, or delete records belonging to another user or tenant by providing a crafted key. This could lead to unauthorized data access, modification, or deletion, compromising data integrity and confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Wheels to version 4.2.0 or later. As a temporary workaround, replace findByKey() and exists(key=) with findOne(where='id = #key#') or findAll(where=...) in authorization-related code paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111445. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart