CVE-2026-111449

5.9 Moyenne

Publiée le 16/10/2026 à 06:18 · Modifiée le 16/10/2026 à 17:19 · Analyse NVD reportée · Source : cve@mitre.org

Description

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.

Traduire en français

Produits concernés

Wheels

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.9 Moyenne	cve@mitre.org	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-362

Références

https://github.com/wheels-dev/wheels/security/advisories/GHSA-8r22-vwcc-v55m

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories