Live › vulnerability › CVE-2026-111449
Go to dashboardWhen allowIPBasedDebugAccess is turned on, an allowed admin request can change error display settings in shared application scope. A concurrent unauthorized request that raises an error can then receive full exception details, including any sensitive data they contain.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Wheels applications that turned on allowIPBasedDebugAccess, since it is disabled by default. The race needs an allowed administrator request overlapping with an unauthorized request that errors, so exposure depends on concurrent traffic. Teams on 4.1.2 or later, or with the setting off, can skip it.
No product ranges from the sources yet.
box.json or wheels dependency; affected range is 3.0.0 through 4.1.1.allowIPBasedDebugAccess and confirm it is set to false (the default).4.1.2.allowIPBasedDebugAccess set to false in production until the upgrade is applied.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-111449")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.