What is CVE-2026-111449?

CVE-2026-111449 is a medium-severity vulnerability in Wheels, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 5.9/10. Published 2026-10-16.

How severe is CVE-2026-111449?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Wheels

CVE-2026-111449

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.

Vulnerability class: Race Condition

Published 2026-10-16 · last modified 2026-10-16.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Wheels

Weakness classification (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

References

github.com/wheels-dev/wheels/security/advisories/GHSA-8r22-vwcc-v55m (vendor-advisory)

Frequently asked questions

What is CVE-2026-111449?: CVE-2026-111449 is a medium-severity vulnerability in Wheels, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 5.9/10. Published 2026-10-16.
How severe is CVE-2026-111449?: Medium severity. CVSS v3 base score is 5.9 out of 10.