CVE-2026-82115

Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request handler Wicket's native WebSocket support uses to deliver an incoming frame, resolves the shared resource named by the client's handshake parameter and calls WebSocketResource#onPayload() on it directly, without consulting IAuthorizationStrategy#isResourceAuthorized(). That method has a single enforcement point in the framework, org.apache.wicket.request.handler.resource.ResourceRequestHandler, which the WebSocket transport does not pass through, and WebSocketResource#respond() is final and empty. No route to a WebSocketResource therefore asks the configured authorization strategy whether the caller may use it, and an @AuthorizeResource annotation on such a class has no effect. A caller needs a bound Wicket session and the name of the resource. The name is not a secret: Wicket writes it into the page that opens the connection. No page of the application is otherwise involved, because a request naming a resource is served with a throwaway page. All of the resource's callbacks are reached this way, including onConnect() and both onMessage() overloads, and what a callback pushes back through WebSocketRequestHandler goes to the caller's own connection. An application is affected where it registers a WebSocketResource as a shared resource and relies on the authorization strategy to restrict it. What the caller gains is whatever that resource's callbacks do with a text or binary message of the caller's choosing. The connection is registered under the caller's own session, so it gives no access to another user's connection. As a workaround, reject unauthorized connections with an IWebSocketConnectionFilter registered through WebSocketSettings#setConnectionFilter(), or repeat the authorization check at the start of each callback. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 7.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.

• CWE-862

• https://lists.apache.org/thread.html/0lj9og7vp22ps77nrwdj42f64cfb9g4c

Published

Nov 1, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82107IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a re…9.6
• CVE-2026-82108IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a re…8.8
• CVE-2026-8211A vulnerability was detected in codelibs Fess up to 15.5.1. …4.7
• CVE-2026-82110IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a re…9.9
• CVE-2026-82111A vulnerability was detected in iswalle getnote-mcp up to 1.…4.3
• CVE-2026-82112A flaw has been found in houtini-ai houtini-lm up to 2.13.2.…3.5
• CVE-2026-82116Missing Authentication for Critical Function Vulnerability i…9.8
• CVE-2026-82117Authentication Bypass by Spoofing Vulnerability in HiRDB. T…9.8
• CVE-2026-82118Stack-based Buffer Overflow Vulnerability in HiRDB. This i…9.8
• CVE-2026-82119OS Command Injection Vulnerability in HiRDB. This issue af…9.8
• CVE-2026-8212A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affec…5.5
• CVE-2026-82120Heap-based Buffer Overflow Vulnerability in HiRDB. This is…9.8