The vulnerability occurs because the Wheels framework’s development tools are exposed under /wheels/* without authentication when enablePublicComponent=true, the default in development settings. An unauthenticated remote client can access these endpoints, retrieve application configuration, datasource credentials, and execution routes, and initiate test runs that run with the same privileges as the application. These test runs can write to the production database, allowing an attacker to modify or delete critical data. No arbitrary code execution is possible; the impact is limited to unauthorized data manipulation.

Versions 4.0.0 through 4.1.2 of Wheels are affected. The default enablePublicComponent=true setting in development mode exposes the vulnerable endpoints. The issue is fixed in 4.2.0 and beyond.

With a CVSS score of 8.6 the vulnerability is high severity. The EPSS score is < 1% and it is not listed in CISA’s KEV catalog. The likely attack vector is a remote client accessing the publicly exposed /wheels/* endpoints, which requires no authentication. The attacker can read sensitive configuration data and write to the live database via test runs, resulting in significant confidentiality, integrity, and availability impact. The separately protected migrator and CLI endpoints are not affected.