Wheels Framework: Broken access control in nested properties (IDOR)
Summary
Wheels 1.1 through 4.1.2 resolves nested form records by primary key from the request without checking that they belong to the parent being saved. An authenticated user who can submit a nested form for their own parent record can modify, reassign or, where allowDelete=true is set, delete child rows of other parents, and edit records via nested belongsTo keys. The flaw can also let a request choose the identity of new child rows with certain composite keys.
Affected
- Wheels 1.1.0 up to and including 4.1.2 (CNA range: 1.1.0 before 4.2.0)
Fixed in
- Fixed in Wheels 4.2.0
- Patch versions below 4.2.0: Unknown.
Workaround
- Do not use allowDelete=true on nested associations whose child keys come from untrusted input.
- Before saving, verify in the controller that every posted nested child key belongs to the parent being edited, or rebuild the nested data server-side from the parent's own children.
Exploitation
- No evidence of exploitation in the wild found. CISA SSVC: exploitation none, automatable no.
- No public proof of concept found in the research performed.
Our recommendation
- Inventory all ColdFusion (CFML) applications built on Wheels and check their version.
- Upgrade affected applications to Wheels 4.2.0 or later; test first in staging, as the 4.2.0 release includes behaviour changes.
- Until upgraded, apply the workarounds and restrict form submission to trusted users on internet-facing or multi-user applications.
- Review logs for unexpected changes to or deletions of nested child records.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6979-65wv-7pxq github.com
- Wheels release v4.2.0 github.com
- VulnDB CVE-2026-111447 vuldb.com
- Vulners CVE-2026-111447 vulners.com
- Strix CVE-2026-111447 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:57.
Original description (NVD)
Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when allowDelete=true. Nested belongsTo records can also be edited by posting another associated record's key. New child rows with composite primary keys not made up of foreign keys retain posted key values, allowing the request to choose their identity. This is fixed in 4.2.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.