CVE-2026-111447
8.1HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-472
Impact
Authenticated users can modify, reassign, or delete records belonging to other parents by submitting arbitrary primary keys in nested forms. They can also forge identities for new child rows with composite primary keys.
Root cause
nestedProperties() resolves child records directly from submitted primary keys without validating that they belong to the parent record being saved.
Affected systems
Wheels 1.1 through 4.1.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade Wheels to version 4.2.0. If upgrading immediately is not possible, disable allowDelete on nestedProperties() and manually validate parent-child ownership in controllers before persisting nested models.
$ box install wheels@4.2.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when allowDelete=true. Nested belongsTo records can also be edited by posting another associated record's key. New child rows with composite primary keys not made up of foreign keys retain posted key values, allowing the request to choose their identity. This is fixed in 4.2.0.