CVE-2026-82705

Apache Wicket (versions 8.0.0-8.19.0 , 9.0.0-9.24.0 , and 10.0.0-10.11.0 ) is vulnerable to a missing authorization flaw. The issue occurs because the framework's IAuthorizationStrategy#isResourceAuthorized() check is only enforced when resources are reached via a ResourceReference. If a componen...