CVE-2026-111449

MediumCVSS 5.9/10Last modified Oct 16, 2026

Description

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
Wheels	Wheels	>= 3.0.0, < 4.1.2

References

https://github.com/wheels-dev/wheels/security/advisories/GHSA-8r22-vwcc-v55m

Timeline

Published: Oct 16, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-111455.3Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTM CVE-2026-1114505.9Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If CVE-2026-1114517.8Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollb CVE-2026-1114526.5Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under camelCase keys such as `pr CVE-2026-1114534.3Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but de CVE-2026-1114546.5Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether t CVE-2026-1114556.5Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID d CVE-2026-1114567.1A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin pack CVE-2026-1114586.8The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The CVE-2026-1114597.6An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthentica CVE-2026-111469.6Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromis CVE-2026-1114607.7A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote att