EUVD-2026-114891

Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized, and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource...

CVE-2026-82705

Apache Wicket (versions 8.0.0-8.19.0 , 9.0.0-9.24.0 , and 10.0.0-10.11.0 ) is vulnerable to a missing authorization flaw. The issue occurs because the framework's IAuthorizationStrategy#isResourceAuthorized() check is only enforced when resources are reached via a ResourceReference. If a componen...