CVE-2026-111449 Wheels CVE debrief

Who should care

Developers and administrators using Wheels 3.0.0 through 4.1.1 should assess exposure and adjust settings or update to a fixed version. This includes reviewing and adjusting allowIPBasedDebugAccess settings, updating to Wheels version 4.1.2 or later, and monitoring for unauthorized requests that could exploit the vulnerability. Security teams and operators should also review the vulnerability and take necessary actions to prevent potential unauthorized

Why it matters

CVE-2026-111449 allows disclosure of detailed exceptions in Wheels 3.0.0 through 4.1.1 when allowIPBasedDebugAccess=true. Developers and administrators should assess exposure, adjust settings, or update to a fixed version to prevent potential unauthorized access to sensitive information.

• Potential disclosure of sensitive data in exception details.
• Possible unauthorized access to detailed exception information.
• Need to verify and adjust allowIPBasedDebugAccess settings.
• Requirement to update to Wheels version 4.1.2 or later for fix.

Technical summary

The Wheels framework can disclose detailed exceptions when allowIPBasedDebugAccess=true and an administrator request overlaps with an unauthorized client's request that raises an error. This can lead to potential unauthorized access to sensitive information. The vulnerability affects Wheels 3.0.0 through 4.1.1 and is fixed in version 4.1.2. Developers and administrators should assess exposure, adjust settings, or update to a fixed version to prevent potential unauthorized access to sensitive information. The vulnerability has a CVSS score of 5.9 and a severity of MEDIUM.

Defensive priority

Assess exposure in applications using Wheels 3.0.0 through 4.1.1 with allowIPBasedDebugAccess=true.

Recommended defensive actions

• Review and adjust allowIPBasedDebugAccess settings in applications using Wheels 3.0.0 through 4.1.1.
• Update to Wheels version 4.1.2 or later.
• Monitor for unauthorized requests that could exploit the vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Wheels 3.0.0 through 4.1.1. The vulnerability allows disclosure of detailed exceptions when allowIPBasedDebugAccess=true. The official CVE Program record and NIST NVD detail page offer source-provided CVE metadata and source-specific vulnerability assessments. The source reference provides additional context for the vulnerability disclosure. The vulnerability has been fixed in Wheels version 4.1.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.