CVE-2026-111447

Wheels 1.1 through 4.1.2 resolves nestedProperties records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when...

CVE-2026-111447

Wheels 1.1 through 4.1.2 resolves nestedProperties records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when...

EUVD-2026-102600

Wheels 1.1 through 4.1.2 resolves nestedProperties records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when...

CVE-2026-111447

Wheels 1.1 through 4.1.2 resolves nestedProperties records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when...

CVE-2026-111447

The Wheels framework (versions 1.1 through 4.1.2 ) contains a vulnerability where nestedProperties() records are resolved using posted primary keys without verifying ownership by the parent record. An authenticated user can exploit this to update, reassign, or delete hasMany or hasOne rows belong...

CVE-2026-111447

Wheels 1.1 through 4.1.2 resolves nestedProperties records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when...

CVE-2026-111447

Wheels 1.1 through 4.1.2 resolves nestedProperties records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when...

PT-2026-115410

Name of the Vulnerable Software and Affected Versions Wheels versions 1.1 through 4.1.2 Description The nestedProperties function resolves records by the posted primary key without verifying if they belong to the parent being saved. This allows a user submitting a nested form to update, reassign,...

CVE-2026-111447: External Control of Assumed-Immutable Web Parameter

Wheels 1.1 through 4.1.2 resolves nestedProperties records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when...

WHEELS.DEV: Wheel

WHEELS.DEV: Versions 1.1 to 4.1.2 contain a vulnerability related to input validation errors. This vulnerability arises from the use of nestedProperties, which parses records based on the primary key submitted by the user. However, it does not verify whether the parsed record is actually a child ...