openmeetings-chat-user-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openmeetings-chat-user-idor Write-up: https://abraxaslabs.tech/research/openmeetings-9-1-0-leftovers openmeetings-chat-user-idor Class: IDOR Reach: Remote Apache OpenMeetings 9.1.0 9773c59e. Any ROOM/DASHBOARD session...

EUVD-2026-114891

Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized, and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource...

Missing Authorization

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

CVE-2026-82705

Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized, and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource...

CVE-2026-82705

Apache Wicket (versions 8.0.0-8.19.0 , 9.0.0-9.24.0 , and 10.0.0-10.11.0 ) is vulnerable to a missing authorization flaw. The issue occurs because the framework's IAuthorizationStrategy#isResourceAuthorized() check is only enforced when resources are reached via a ResourceReference. If a componen...

CVE-2026-82705 Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component

Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized, and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource...

PT-2026-135043

Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized, and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource...

CVE-2026-82705: Apache Software Foundation Apache Wicket: Missing authorization in Apache Wicket

Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized, and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource...