EUVD-2026-114891

Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized, and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource...

EUVD-2026-114890

Missing authorization in Apache Wicket. org.apache.wicket.core.request.handler.ListenerRequestHandler invokes an IRequestListener only when org.apache.wicket.ComponentcanCallListener allows it, and that method is isEnabledInHierarchy && isVisibleInHierarchy. The visibility half reads a flag that...

EUVD-2026-114888

Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage callbacks without checking whether the client may invoke the component the behavi...

EUVD-2026-114886

Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request handler Wicket's native WebSocket support uses to deliver an incoming frame, resolves the shared resource named by the client's handshake parameter and calls...

CVE-2026-82898

Apache Wicket versions 9.1.0 through 9.24.0 and 10.0.0 through 10.11.0 are vulnerable to a security bypass due to an incorrect order of security checks in ResourceIsolationRequestCycleListener. The listener obtains the target page before consulting isolation policies; if the page throws RestartRe...

CVE-2026-82115

A missing authorization vulnerability in Apache Wicket allows unauthorized access to shared WebSocketResource objects. The root cause is that WebSocketMessageBroadcastHandler calls WebSocketResource#onPayload() directly without consulting IAuthorizationStrategy#isResourceAuthorized(), bypassing t...