CVE-2026-111447: High severity CFWheels Wheels vulnerability
Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when allowDelete=true. Nested belongsTo records can also be edited by posting another associated record's key. New child rows with composite primary keys not made up of foreign keys retain posted key values, allowing the request to choose their identity. This is fixed in 4.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wheelsto a version that resolves this vulnerability.Fixed in 4.2.0
Event History
Frequently Asked Questions
Which deployments are exposed?
CFWheels applications using Wheels versions 1.1 through 4.1.2 are affected if they accept nested form submissions through nestedProperties(). The issue affects hasMany, hasOne, and belongsTo nested associations, with deletion exposure when allowDelete=true.
What access does an attacker need?
An attacker needs network access and privileges sufficient to submit a nested form for a parent record they can edit. No user interaction is required; they can supply another associated record's primary key in the nested request.
What could an attacker do?
They can modify or reassign another parent's hasMany or hasOne records, delete those records when allowDelete=true, or edit nested belongsTo records by posting another associated record's key. For new child records with composite primary keys not composed of foreign keys, they can also choose the posted record identity.
How can this be remediated?
Upgrade to Wheels 4.2.0, which fixes the missing ownership validation during nestedProperties() resolution.