CVE-2026-111447 Details

A vulnerability in Wheels versions 1.1 through 4.1.2 allows users to manipulate nested properties of associated records without proper authorization. The issue arises because the framework's nestedProperties() function resolves associated records by their primary keys, without verifying that they belong to the parent record being saved. This flaw enables a user to update, reassign, or delete another user's associated records, particularly in hasMany or hasOne relationships. The vulnerability also extends to nested belongsTo records, which can be edited by posting the key of an associated record from a different parent. Additionally, new child records with composite primary keys that do not consist of foreign keys can have their identity manipulated by retaining posted key values.

The vulnerability is fixed in Wheels version 4.2.0. Users can update to this version to address the issue. For those using earlier versions, it is recommended to avoid setting allowDelete=true on nested associations with child keys from untrusted sources. Additionally, before saving, verify that all posted nested child keys belong to the parent being edited, or reconstruct the nested structure on the server side from the parent's existing children.