EUVD-2026-114893

Incorrect order of security checks in Apache Wicket. org.apache.wicket.protocol.http.ResourceIsolationRequestCycleListener obtains the page a request targets before it consults its resource isolation policies, because those policies are passed that page. Obtaining the page instantiates it, and...

CVE-2026-82898

Incorrect order of security checks in Apache Wicket. org.apache.wicket.protocol.http.ResourceIsolationRequestCycleListener obtains the page a request targets before it consults its resource isolation policies, because those policies are passed that page. Obtaining the page instantiates it, and...

CVE-2026-82898

Apache Wicket versions 9.1.0 through 9.24.0 and 10.0.0 through 10.11.0 are vulnerable to a security bypass due to an incorrect order of security checks in ResourceIsolationRequestCycleListener. The listener obtains the target page before consulting isolation policies; if the page throws RestartRe...