{"id":"CVE-2026-111449","kind":"vulnerability","aliases":["CVE-2026-111449"],"related":[],"title":"Wheels: debug error details can leak to unauthorized clients under a race","description":"Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.","summary":"When allowIPBasedDebugAccess is turned on, an allowed admin request can change error display settings in shared application scope. A concurrent unauthorized request that raises an error can then receive full exception details, including any sensitive data they contain.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coldfusion","lucee","package","self-hosted","wheels"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the Wheels version in the app's `box.json` or `wheels` dependency; affected range is `3.0.0` through `4.1.1`.\n- Check the application config for `allowIPBasedDebugAccess` and confirm it is set to `false` (the default).","fix":"- Upgrade Wheels to `4.1.2`.\n- Keep `allowIPBasedDebugAccess` set to `false` in production until the upgrade is applied.","status":"open","published_at":"2026-10-16T04:18:31+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:09:53+00:00","updated_at":"2026-10-25T04:09:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:09:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Wheels to `4.1.2`.\n- Keep `allowIPBasedDebugAccess` set to `false` in production until the upgrade is applied.","reach":"internet","title":"Wheels: debug error details can leak to unauthorized clients under a race","impact":"medium","summary":"When allowIPBasedDebugAccess is turned on, an allowed admin request can change error display settings in shared application scope. A concurrent unauthorized request that raises an error can then receive full exception details, including any sensitive data they contain.","category":"package","nicknames":[],"who_cares":["wheels","coldfusion","lucee","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthorized clients read full exception details and any sensitive data in them","analyst_note":"","how_to_check":"- Check the Wheels version in the app's `box.json` or `wheels` dependency; affected range is `3.0.0` through `4.1.1`.\n- Check the application config for `allowIPBasedDebugAccess` and confirm it is set to `false` (the default).","needs_analyst":false,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Only Wheels applications that turned on allowIPBasedDebugAccess, since it is disabled by default. The race needs an allowed administrator request overlapping with an unauthorized request that errors, so exposure depends on concurrent traffic. Teams on 4.1.2 or later, or with the setting off, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000617,"input_tokens":3398,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111449':15A,18A '-2026':14A,17A '3.0.0':65C '4.1.1':67C '4.1.2':137C 'admin':33B 'administr':80C 'allow':32B,79C 'allowipbaseddebugaccess':27B,73C 'applic':42B,87C 'bypass':126C 'chang':36B,82C 'client':9A,95C,103C 'coldfus':19B 'concurr':45B 'contain':63B,121C 'context':111C 'cve':13A,16A 'data':61B,119C 'debug':2A 'default':77C 'detail':4A,57B,70C,108C 'develop':131C 'disabl':75C 'disclos':69C 'display':38B 'error':3A,37B,51B,101C 'error/debug-display':83C 'except':56B,71C,107C,115C 'fix':135C 'full':55B,106C 'gate':129C 'host':24B 'includ':58B,109C 'leak':6A 'luce':20B 'overlap':91C 'packag':21B 'product':128C 'protect':130C 'race':12A,123C 'rais':49B,99C 'receiv':54B,105C 'request':34B,47B,81C,97C 'scope':43B,88C 'self':23B 'self-host':22B 'sensit':60B,118C 'serial':114C 'set':39B,84C 'share':41B,86C 'tag':110C 'tool':132C 'true':74C 'turn':29B 'unauthor':8A,46B,94C 'wheel':1A,25B,64C","nicknames":[],"mitigations":[],"who_affected":"Only Wheels applications that turned on allowIPBasedDebugAccess, since it is disabled by default. The race needs an allowed administrator request overlapping with an unauthorized request that errors, so exposure depends on concurrent traffic. Teams on 4.1.2 or later, or with the setting off, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T04:18:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111449","severity":null,"published_at":"2026-10-16T04:18:31+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}