---
id: "CVE-2026-111447"
kind: "vulnerability"
aliases: ["CVE-2026-111447"]
title: "Wheels: nested form saves can rewrite or delete other parents' records"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cfml", "coldfusion", "lucee", "package", "self-hosted", "wheels"]
not_affected_if: ["no-nestedproperties", "no-user-submitted-nested-forms", "versions-4.2.0-or-later"]
published_at: "2026-10-16T04:18:30+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:07:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111447", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Wheels: nested form saves can rewrite or delete other parents' records

Wheels (a CFML framework) resolves nestedProperties() records by the primary key a user posts, without checking they belong to the parent being saved. An authenticated user who can submit a nested form for their own parent can update, reassign, or (with allowDelete=true) delete another parent's child rows.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Wheels version in the application's dependencies: `4.1.2` or earlier is affected, `4.2.0` is fixed.
- Search controllers for `nestedProperties(` and check whether `allowDelete` is set to `true`.

## Fix

- Upgrade Wheels to `4.2.0` or later.
- Until upgraded, restrict nested form submissions to records the current user owns, and avoid `allowDelete=true` on nested associations.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111447

## From the sources

Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when allowDelete=true. Nested belongsTo records can also be edited by posting another associated record's key. New child rows with composite primary keys not made up of foreign keys retain posted key values, allowing the request to choose their identity. This is fixed in 4.2.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_