CVE-2026-111449
Received Received - Intake

Information Disclosure in Wheels Framework

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: MITRE

Description
Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111449
EUVD
EUVD-2026-102602

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wheels Wheels 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Wheels framework versions 3.0.0 to 4.1.1. When IP-based debug access is enabled, error details are written to a shared application scope. If an unauthorized request overlaps with an allowed administrator's debug request and raises an error, the unauthorized client may receive full exception details, including sensitive data like tag context or serialized exceptions.

Detection Guidance

Check Wheels framework version with command: wheels version. If version is between 3.0.0 and 4.1.1, the system is vulnerable. Inspect Application.cfc for IP-based debug access settings like allowIPBasedDebugAccess=true. Monitor for concurrent requests raising errors that expose sensitive data in responses.

Impact Analysis

An attacker could exploit this to access sensitive information in error messages, such as internal application data, configuration details, or user-specific data. This could lead to further attacks or data breaches if the exposed data is used maliciously.

Compliance Impact

This vulnerability could violate compliance requirements that mandate protection of sensitive data, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized exposure of such data may result in legal penalties or regulatory fines.

Mitigation Strategies

Upgrade Wheels to version 4.1.2 or later immediately. Alternatively, disable IP-based debug access by setting allowIPBasedDebugAccess=false in Application.cfc. Remove IP-based debug blocks until upgrading. Avoid runtime changes to debug settings in old Application.cfc.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111449. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart