Wheels versions 1.1 through 4.1.2 contain a flaw in the handling of nested form submissions. The application resolves nestedProperties() records by posted primary key without verifying that the key belongs to the parent record being saved. This allows an authenticated user to submit a nested form for a parent record they own and to alter or delete rows that belong to other parents, including hasMany and hasOne associations, when allowDelete is enabled. The vulnerability is a classic example of insecure indirect object reference (CWE-472) and can lead to data integrity violations, unauthorized reassignment of records, or deletion of unrelated data.

The issue affects Wheels operated by the Wheels:Wheels product. Vulnerable releases range from 1.1 up to and including 4.1.2. The fix is available in release 4.2.0, which corrects the validation of nested primary keys.

The CVSS score of 8.1 classifies the vulnerability as high, while the EPSS score is 0.00278 and it is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to be authenticated to the application and to submit a nested form with fabricated primary keys. Upon exploitation, the attacker can reassign or delete records belonging to other users, thereby compromising data integrity. Given the lack of publicly documented exploits, the exploitation difficulty appears moderate but the potential impact is significant.