{"id":"CVE-2026-111447","kind":"vulnerability","aliases":["CVE-2026-111447"],"related":[],"title":"Wheels: nested form saves can rewrite or delete other parents' records","description":"Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when allowDelete=true. Nested belongsTo records can also be edited by posting another associated record's key. New child rows with composite primary keys not made up of foreign keys retain posted key values, allowing the request to choose their identity. This is fixed in 4.2.0.","summary":"Wheels (a CFML framework) resolves nestedProperties() records by the primary key a user posts, without checking they belong to the parent being saved. An authenticated user who can submit a nested form for their own parent can update, reassign, or (with allowDelete=true) delete another parent's child rows.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cfml","coldfusion","lucee","package","self-hosted","wheels"],"not_affected_if":["no-nestedproperties","no-user-submitted-nested-forms","versions-4.2.0-or-later"],"how_to_check":"- Check the Wheels version in the application's dependencies: `4.1.2` or earlier is affected, `4.2.0` is fixed.\n- Search controllers for `nestedProperties(` and check whether `allowDelete` is set to `true`.","fix":"- Upgrade Wheels to `4.2.0` or later.\n- Until upgraded, restrict nested form submissions to records the current user owns, and avoid `allowDelete=true` on nested associations.","status":"open","published_at":"2026-10-16T04:18:30+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:07:50+00:00","updated_at":"2026-10-25T03:07:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:07:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Wheels to `4.2.0` or later.\n- Until upgraded, restrict nested form submissions to records the current user owns, and avoid `allowDelete=true` on nested associations.","reach":"internet","title":"Wheels: nested form saves can rewrite or delete other parents' records","impact":"high","summary":"Wheels (a CFML framework) resolves nestedProperties() records by the primary key a user posts, without checking they belong to the parent being saved. An authenticated user who can submit a nested form for their own parent can update, reassign, or (with allowDelete=true) delete another parent's child rows.","category":"package","nicknames":[],"who_cares":["wheels","cfml","coldfusion","lucee","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker rewrites or deletes other tenants' child records.","analyst_note":"","how_to_check":"- Check the Wheels version in the application's dependencies: `4.1.2` or earlier is affected, `4.2.0` is fixed.\n- Search controllers for `nestedProperties(` and check whether `allowDelete` is set to `true`.","needs_analyst":false,"not_affected_if":["no-nestedproperties","versions-4.2.0-or-later","no-user-submitted-nested-forms"],"who_is_affected":"Applications running Wheels 1.1 through 4.1.2 that use nestedProperties() to save hasMany, hasOne or belongsTo associations from user-submitted forms. The risk is highest where a logged-in user can submit a nested form for a parent they own. Applications without nestedProperties() usage, or where only trusted staff submit nested forms, are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":3396,"output_tokens":621,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111447':14A,17A '-2026':13A,16A '1.1':76C '4.1.2':78C '4.2.0':167C 'abl':98C 'allow':156C 'allowdelet':67B,123C 'also':129C 'anoth':70B,112C,134C 'associ':135C 'authent':50B 'belong':43B,90C 'belongsto':126C 'cfml':18B,28B 'check':41B,87C 'child':73B,140C 'choos':160C 'coldfus':19B 'composit':143C 'cve':12A,15A 'delet':8A,69B,120C 'edit':131C 'fix':165C 'foreign':150C 'form':3A,57B,103C 'framework':29B 'hasmani':115C 'hason':117C 'host':24B 'ident':162C 'key':36B,85C,138C,145C,151C,154C 'luce':20B 'made':147C 'nest':2A,56B,102C,125C 'nestedproperti':31B,80C 'new':139C 'packag':21B 'parent':10A,46B,61B,71B,93C,107C,113C 'post':39B,83C,133C,153C 'primari':35B,84C,144C 'reassign':64B,111C 'record':11A,32B,81C,127C,136C 'request':158C 'resolv':30B,79C 'retain':152C 'rewrit':6A 'row':74B,118C,141C 'save':4A,48B,95C 'self':23B 'self-host':22B 'submit':54B,100C 'true':68B,124C 'updat':63B,109C 'user':38B,51B,97C 'valu':155C 'wheel':1A,25B,26B,75C 'without':40B,86C","nicknames":[],"mitigations":[],"who_affected":"Applications running Wheels 1.1 through 4.1.2 that use nestedProperties() to save hasMany, hasOne or belongsTo associations from user-submitted forms. The risk is highest where a logged-in user can submit a nested form for a parent they own. Applications without nestedProperties() usage, or where only trusted staff submit nested forms, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T04:18:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111447","severity":null,"published_at":"2026-10-16T04:18:30+00:00","modified_at":"2026-10-21T03:17:18+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}