{"id":"CVE-2026-111450","kind":"vulnerability","aliases":["CVE-2026-111450"],"related":[],"title":"Wheels: Host header sets default error-email recipient, leaking error data","description":"Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request triggers a cold start can direct later error emails to an address under their control for that application's lifetime. Emails disclose error and request metadata; on engines/versions where scope dumps render, they may also disclose configuration secrets and other users' session/cookie data. On the Lucee 7 engine, scope dumps fail to render, limiting disclosure to header fields. This is fixed in 4.1.2.","summary":"Wheels through 4.1.1 takes its default production error-email address from the Host header of the request that starts the application. An attacker who triggers a cold start with a chosen Host can redirect later error emails to an address they control, exposing error and request metadata, and possibly configuration secrets or session data on some engines.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cfml","coldfusion","lucee","package","self-hosted","wheels"],"not_affected_if":["explicit-error-email-recipient","no-mail-server","wheels-4.1.2-or-later"],"how_to_check":"- Check the Wheels version in the application's dependencies (`4.1.1` or earlier is affected)\n- Check whether an explicit error-email recipient is set in the Wheels configuration; if it is, the default is not used\n- Check whether a mail server is configured for the application","fix":"- Upgrade Wheels to `4.1.2`\n- Set an explicit error-email recipient in the Wheels configuration as an interim measure","status":"open","published_at":"2026-10-16T04:18:31+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:09:53+00:00","updated_at":"2026-10-25T04:09:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:09:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Wheels to `4.1.2`\n- Set an explicit error-email recipient in the Wheels configuration as an interim measure","reach":"internet","title":"Wheels: Host header sets default error-email recipient, leaking error data","impact":"medium","summary":"Wheels through 4.1.1 takes its default production error-email address from the Host header of the request that starts the application. An attacker who triggers a cold start with a chosen Host can redirect later error emails to an address they control, exposing error and request metadata, and possibly configuration secrets or session data on some engines.","category":"package","nicknames":[],"who_cares":["wheels","coldfusion","lucee","cfml","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Error emails and possibly secrets or session data sent to attacker","analyst_note":"","how_to_check":"- Check the Wheels version in the application's dependencies (`4.1.1` or earlier is affected)\n- Check whether an explicit error-email recipient is set in the Wheels configuration; if it is, the default is not used\n- Check whether a mail server is configured for the application","needs_analyst":false,"not_affected_if":["explicit-error-email-recipient","no-mail-server","wheels-4.1.2-or-later"],"who_is_affected":"Applications running Wheels 4.1.1 or earlier that send production error emails, have no explicit error-email recipient configured, and have a mail server configured that accepts arbitrary Host values. Applications with an explicit recipient set, or with no mail server, are not exposed through this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000631,"input_tokens":3419,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111450':15A,18A '-2026':14A,17A '4.1.1':29B,87C '4.1.2':196C '7':180C 'accept':124C 'address':37B,67B,95C,145C 'also':168C 'applic':48B,106C,151C 'attack':50B,127C,131C 'attacker-chosen':126C 'cfml':19B 'chosen':58B,128C 'cold':54B,136C 'coldfus':20B 'configur':77B,115C,120C,170C 'control':69B,148C 'cve':13A,16A 'data':12A,81B,176C 'default':5A,32B,90C 'deriv':88C 'direct':139C 'disclos':155C,169C 'disclosur':188C 'dump':164C,183C 'email':8A,36B,64B,94C,112C,142C,154C 'engin':84B,181C 'engines/versions':161C 'error':7A,11A,35B,63B,71B,93C,111C,141C,156C 'error-email':6A,34B,92C,110C 'explicit':109C 'expos':70B 'fail':184C 'field':191C 'fix':194C 'header':3A,41B,99C,190C 'host':2A,25B,40B,59B,98C,129C 'later':62B,140C 'leak':10A 'lifetim':153C 'limit':187C 'luce':21B,179C 'mail':117C 'may':167C 'metadata':74B,159C 'packag':22B 'possibl':76B 'product':33B,91C 'recipi':9A,113C 'redirect':61B 'render':165C,186C 'request':44B,73B,102C,133C,158C 'scope':163C,182C 'secret':78B,171C 'self':24B 'self-host':23B 'server':118C,123C 'session':80B 'session/cookie':175C 'set':4A 'start':46B,55B,104C,137C 'take':30B 'trigger':52B,134C 'user':174C 'wheel':1A,26B,27B,85C 'whose':132C","nicknames":[],"mitigations":[],"who_affected":"Applications running Wheels 4.1.1 or earlier that send production error emails, have no explicit error-email recipient configured, and have a mail server configured that accepts arbitrary Host values. Applications with an explicit recipient set, or with no mail server, are not exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T04:18:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111450","severity":null,"published_at":"2026-10-16T04:18:31+00:00","modified_at":"2026-10-19T19:17:23+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}