The vulnerability allows an attacker to weaponize the Host header during a cold start of Wheels, causing the application to use that value as the default error‑email recipient. If the mail server accepts the attacker‑chosen address, future error notifications are sent to the attacker, leaking error records, request headers, and, on some engine versions, configuration secrets or session cookies.

All Wheels installations using version 4.1.1 or earlier are affected. The issue exists in the Wheels package when no explicit error‑email recipient is configured.

The CVSS score of 5.9 indicates moderate severity. Exploitation requires control over the application’s initial request and a mail server that accepts the injected Host header; the attacker must generate an error after a cold start, limiting the attack window. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of widespread exploitation.