CVE-2026-111447

Wheels 1.1 through 4.1.2 resolves nestedProperties records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when...

CVE-2026-111447

The Wheels framework (versions 1.1 through 4.1.2 ) contains a vulnerability where nestedProperties() records are resolved using posted primary keys without verifying ownership by the parent record. An authenticated user can exploit this to update, reassign, or delete hasMany or hasOne rows belong...

EUVD-2026-102600

Wheels 1.1 through 4.1.2 resolves nestedProperties records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when...