CVE-2026-111447

The Wheels framework (versions 1.1 through 4.1.2 ) contains a vulnerability where nestedProperties() records are resolved using posted primary keys without verifying ownership by the parent record. An authenticated user can exploit this to update, reassign, or delete hasMany or hasOne rows belong...