Low [CVE-2026-82558] Missing authorization in Apache Wicket
This low-severity Apache Software Foundation advisory covers CVE-2026-82558 affecting Apache Wicket.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation publishes the next one.
See Apache Software Foundation's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
Missing authorization in Apache Wicket.
org.apache.wicket.protocol.ws.api. WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage() callbacks without checking whether the client may invoke the component the behavior is attached to.
Wicket opens a single WebSocket connection per page, and a message received on it is delivered to every WebSocketBehavior of that page.
For an Ajax behavior Wicket makes this check before invoking it, through Behavior#canCallListener(Component), which refuses a component that is not visible or not enabled, including one for which the IAuthorizationStrategy denies the RENDER or ENABLE action.
A WebSocketBehavior attached to such a component, or to a child of one, therefore receives the client's text and binary messages, together with a WebSocketRequestHandler that writes back to that client, where an Ajax behavior on the same component would be refused.
An application is affected where it attaches a WebSocketBehavior that overrides onMessage() to a component that it hides, disables, or restricts through its IAuthorizationStrategy, for example with MetaDataRoleAuthorizationStrategy or the AuthorizeAction annotation.
- 8.0.0 through 8.19.0
- 9.0.0 through 9.24.0
- 10.0.0 through 10.11.0.
- through 10.11.0
Official advisory · high-confidence parse· fetched 10 hours ago·verify at source
- 8.20.0
- 9.25.0
- 10.12.0
Official advisory · high-confidence parse· fetched 10 hours ago·verify at source
Mitigation checklist
- For an Ajax behavior Wicket makes this check before invoking it, through Behavior#canCallListener(Component), which refuses a component that is not visible or not enabled, including one for which the IAuthorizationStrategy denies the RENDER or ENABLE action.
- Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.
Official advisory · high-confidence parse· fetched 10 hours ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-111089Nov 1, 2026Apache Wicket reads texts from the application's resource bundles — a localized label
- CVE-2026-95863Nov 1, 2026Apache Wicket cross-site scripting (XSS)
- CVE-2026-87718Nov 1, 2026Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers
- CVE-2026-84231Nov 1, 2026Apache Wicket cross-site scripting (XSS)
- CVE-2026-84177Nov 1, 2026Incorrect behavior order in Apache Wicket: a file path is validated before the framework
- CVE-2026-84172Nov 1, 2026Files accessible to external parties in Apache Wicket
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.