CVE-2026-111445 Details

A vulnerability in Wheels versions 4.0.0 through 4.1.2 prior to 4.2.0 allows scope conditions to be replaced with primary-key conditions in certain finder methods. This issue arises in scope-aware finders like 'findByKey()' and 'exists(key=...)', where the expected scope conditions for ownership or tenant authorization are ignored. As a result, applications can inadvertently access, modify, or delete records belonging to other users or tenants, based on keys received in requests. The vulnerability is particularly concerning for applications that rely on scopes for multi-tenancy or authorization, as it can lead to unauthorized data access and manipulation.

Users can upgrade to Wheels version 4.2.0 or later, where this vulnerability is fixed. In version 4.2.0, the affected methods 'findByKey()', 'exists(key=...)', 'updateByKey()', and 'deleteByKey()' have been modified to combine key conditions with incoming scope chains, query builders, or 'where' arguments, ensuring that out-of-scope keys do not match any records. For immediate workarounds, 'findOne(where="id = #key#")' or 'findAll(where=...)' can be used on the scope chain instead of 'findByKey()', or ownership checks can be performed after loading a record.