CVE-2026-111445

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111445

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111445.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111445

Aliases

GHSA-2qh9-qcxq-f8qc

Published

2026-10-16T03:35:00Z

Modified

2026-10-17T02:47:43Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or tenant authorization can therefore load and subsequently modify or delete another user's or tenant's record when the key comes from a request. The 4.2.0 fix combines key conditions with incoming scope, query-builder or where conditions in findByKey(), exists(key=), updateByKey() and deleteByKey(). Other scope-aware finders, aggregates, updateAll() and deleteAll() are not affected.

Database specific

{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-669"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111445.json"
}

References

Affected packages

Git / github.com/wheels-dev/wheels

Affected ranges

Type

GIT

Repo

https://github.com/wheels-dev/wheels

Events

Introduced

3914c9080bb33276b1bdbde10a84323f4041200c

Fixed

0e589def0922a3f0643cfd17c4ea5fdd8c41b9a6

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.2.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111445.json"