Wheels Framework CVE-2026-111449

Exploitation requires the non-default setting allowIPBasedDebugAccess=true to be explicitly enabled (it is disabled by default), plus winning a narrow timing race: an authorized administrator request must be changing error/debug-display settings in shared application scope at the same moment an unauthorized client's request raises an error. Key limiting factors are this required non-default configuration and the race-condition timing dependency (reflected in AC:H), and the fact that the flaw does not bypass the production gate protecting developer tools - so standard production hardening still constrains it. Only confidentiality is affected (exposure of exception details, tag context, or serialized exceptions and any sensitive data within).

This is a moderate-severity information-disclosure issue (CVSS 5.9, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) whose real-world risk is substantially lower than its network vector might suggest. The signals are internally consistent and point away from urgent prioritization: AC:H reflects the dependence on a hard-to-control race window (CWE-362), and exploitation is gated behind allowIPBasedDebugAccess=true, which the advisory states is disabled by default. There is no CISA KEV listing and no public proof-of-concept identified, so exploitation status is 'no public exploit identified at time of analysis'. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified - this is a data gap rather than a low score. The confidentiality-only impact (C:H, I:N, A:N) means the worst case is leakage of exception details, tag context, or serialized exception objects and any sensitive data they contain, with no integrity or availability consequence. Net assessment: a genuine but conditional, low-to-moderate priority flaw - relevant mainly to the subset of deployments that have explicitly enabled IP-based debug access.

An organization runs a Wheels (CFWheels/CFML) application that has deliberately enabled allowIPBasedDebugAccess=true. While an authorized administrator's request is updating error/debug-display settings held in shared application scope, an unauthorized client happens to send a request that raises an error during that narrow window and receives the full exception details instead of a sanitized message. No public exploit code is known, and the AC:H rating reflects that an attacker must win this timing race rather than trigger the flaw deterministically.