Wheels CVE-2026-110911

Exploitation requires an application built on Wheels 1.1.8-4.1.1 that passes caller-supplied string (non-numeric) values into one of the affected APIs: dynamic finders (e.g. findOneByEmail), where(property, value) / where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey, findOrCreateBy...), or validatesUniquenessOf. The concrete trigger is a quoted value containing a doubled single quote, which the parser wrongly treats as the end of the literal. LIMITING FACTORS: numeric-column values are NOT exploitable; the whereBetween() variant (4.0.0-4.1.1 only) is additionally gated on MySQL/MariaDB running with backslash escaping enabled; and exploitation is only remote/unauthenticated where the application actually forwards untrusted request data to these calls rather than sanitizing or parameterizing it first.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) treats this as a remote, unauthenticated, low-complexity SQL injection with full CIA impact (CWE-89). That rating is plausible but conditional: the flaw lives in framework APIs (dynamic finders like findOneByEmail, where()/whereBetween(), *ByKey lookups, findOrCreateBy..., validatesUniquenessOf), so network-reachable unauthenticated exploitation only materializes when an application actually routes untrusted request data into those calls - which is common but not guaranteed, so real-world risk is application-dependent rather than universal. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 9.8 therefore reflects theoretical severity, not demonstrated mass exploitation. Mitigating nuances the raw score hides: numeric-column values are not affected, and the whereBetween() variant (4.0.0-4.1.1) is further gated on MySQL/MariaDB with backslash escaping enabled. Net: a genuine high priority for teams running Wheels apps that expose these APIs to user input (especially auth, password-reset, and token lookups), but the low real-world footprint of the product tempers absolute risk - treat as patch-urgent for affected deployments rather than an internet-wide emergency.

An attacker submits a crafted value - e.g. an email or token containing a doubled single quote - to a login, password-reset, or lookup endpoint whose handler calls a Wheels dynamic finder such as findOneByEmail or where(property, value). Because the parser mistreats the doubled quote as the end of a string literal, the remainder of the attacker's input is parsed as SQL, letting them bypass authentication or read unauthorized rows. No authentication or user interaction is required when the vulnerable API is exposed to request data; no public exploit code was identified in the provided data.