Wheels 4.0.6 through 4.1.2 contain a flaw that allows an unauthenticated client to switch request processing into a separate test application context by supplying an X‑Wheels‑Test‑Context header, a WHEELS_TEST_CONTEXT cookie, or including a test‑runner path in the URL query. This allows the attacker to bypass runtime‑only maintenance mode, activate a separate in‑memory rate‑limit counter, and trigger additional application‑startup side effects such as increased memory usage. The vulnerability is an instance of CWE‑348: Unrestricted Request Routing, and while it does not provide direct code execution or database access, it grants the attacker the ability to influence the application environment and potentially expose internal test functionality in a production deployment.

The vulnerability applies to Wheels version 4.0.6 up to and including 4.1.2. The product is Wheels, managed by the Wheels development team. Versions prior to 4.2.0 are affected.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is < 1%, indicating a very low exploitation probability, and the flaw is not listed in CISA's KEV catalog, suggesting a low to moderate exploitation probability at present. The risk is primarily limited to clients that can reach the application over the network, as the attacker only needs to add a custom HTTP header, cookie, or URL path. No authentication or privileged access is required, but the impact could allow an attacker to manipulate the application’s operational state and use resources more broadly than intended.