CVE-2026-111450 Details

A vulnerability in Wheels versions through 4.1.1 allows an attacker to redirect production error emails to an address under their control by manipulating the Host header. This issue arises because the default error-email recipient is derived from the Host header of the initial request that starts the application. If no explicit recipient is configured and a mail server is available, an attacker can exploit this behavior. When an error occurs, the email sent includes error details and request metadata, which could also contain configuration secrets and other users' session or cookie data, depending on the engine and version. On Lucee 7, only header fields are disclosed, as scope dumps do not render.

Update to Wheels version 4.1.2 or later, where this vulnerability is fixed. Alternatively, explicitly set the error email addresses in the production settings file or disable error email notifications.