CVE-2026-82704

Apache Wicket versions 8.0.0 through 8.19.0 , 9.0.0 through 9.24.0 , and 10.0.0 through 10.11.0 are vulnerable to a missing authorization flaw. The root cause is that ListenerRequestHandler invokes an IRequestListener before Component#configure() runs. If a request omits the page identifier in a ...