Wheels 3.0.0 through 4.1.1 allow an administrator to change the error/debug‑display settings in shared application scope when the allowIPBasedDebugAccess flag is enabled. A race occurs if an unauthorized client simultaneously triggers an error that raises an exception. The admin change can overlap with the client’s request, causing the client to receive full exception details, including tag context, a serialized exception, and any sensitive data contained within that exception. This vulnerability does not provide a path to execute code or bypass the developer‑tools production gate; it merely exposes potentially confidential information through error messaging.

Products affected are Wheels versions 3.0.0 through 4.1.1. The vulnerability exists only when allowIPBasedDebugAccess is set to true, which by default is disabled. The fix is released in Wheels 4.1.2.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is 0.0021, indicating a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires the attacker to induce an error response while an administrator is concurrently changing debug settings. The race condition is non‑deterministic, so exploitation probability is uncertain but feasible in environments where debug access can be enabled or administrators modify error settings during operation.