CVE-2026-111445 | Wheels up to 4.1.2 Query Builder key improper authorization

October 16, 2026 Yanac

A vulnerability categorized as critical has been discovered in Wheels up to 4.1.2. Affected by this vulnerability is the function findByKey/exists/updateByKey/deleteByKey/updateAll/deleteAll of the component Query Builder. Such manipulation of the argument key leads to improper authorization.

This vulnerability is listed as CVE-2026-111445. The attack may be performed from remote. There is no available exploit.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More