CVE-2026-111446

{
  "etk_id": "ETK-2026-1750",
  "cve_id": "CVE-2026-111446",
  "display_id": "CVE-2026-111446",
  "ghsa_id": "GHSA-5pfh-pw79-rgrh",
  "euvd_id": "EUVD-2026-102608",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper access control for development tools in Wheels",
  "summary": "Wheels 4.0.0 through 4.1.2 can expose development endpoints to remote unauthenticated clients when enablePublicComponent is enabled, including by default in development configurations. An attacker may read application and datasource information, view routes, and trigger test runs; tests using the primary datasource may alter production data.",
  "mitigation": "Upgrade Wheels to version 4.2.0. Until the upgrade is complete, disable enablePublicComponent or restrict access to the /wheels/ endpoints to trusted local clients.",
  "vendor": "Wheels",
  "product": "Wheels",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0, <= 4.1.2"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "4.2.0"
      ],
      "package_name": "wheels",
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
  "epss_score": 0.0026,
  "epss_percentile": 0.1679,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 65.09368655,
  "t0_at": "2026-10-16T03:37:32.158000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-16T03:37:32.158000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T03:37:32.158000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111446"
    }
  }
}