CVE-2026-82557 Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission

Missing authorization in Apache Wicket. org.apache.wicket.markup.html.form.Form resolves the component that submitted a form from the request parameters in FormonRequest and passes the result directly to FormonFormSubmittedIFormSubmitter. The check that the submitting component is visible and...

CVE-2026-82557

Apache Wicket versions 10.3.0 through 10.11.0 are vulnerable to a missing authorization issue in the org.apache.wicket.markup.html.form.Form component. The root cause is that Form#onRequest() resolves the submitting component from request parameters and passes it to Form#onFormSubmitted() without...