CVE-2026-111449CWE-362

CVE-2026-111449

Medium · published October 16, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
10.7
In the wild
Unconfirmed
What it is

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.7th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-10-16T08:18Z
References (1)
https://github.com/wheels-dev/wheels/security/advisories/GHSA-8r22-vwcc-v55m · [email protected]
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 16 OCT 03:44Z
    Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default)
    cvelistv5
  • 16 OCT 03:44Z
    Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default)
    cvelistv5