CVE-2026-82558

Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage() callbacks without checking whether the client may invoke the component the behavior is attached to. Wicket opens a single WebSocket connection per page, and a message received on it is delivered to every WebSocketBehavior of that page. For an Ajax behavior Wicket makes this check before invoking it, through Behavior#canCallListener(Component), which refuses a component that is not visible or not enabled, including one for which the IAuthorizationStrategy denies the RENDER or ENABLE action. A WebSocketBehavior attached to such a component, or to a child of one, therefore receives the client's text and binary messages, together with a WebSocketRequestHandler that writes back to that client, where an Ajax behavior on the same component would be refused. An application is affected where it attaches a WebSocketBehavior that overrides onMessage() to a component that it hides, disables, or restricts through its IAuthorizationStrategy, for example with MetaDataRoleAuthorizationStrategy or the AuthorizeAction annotation. The client needs a session of their own and a page of their own that contains such a component: messages are delivered only to pages in the page store of the client's own session, so this gives no access to another user's session, page or connection. Messages pushed by the server are not affected. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 6.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.

• CWE-862

• https://lists.apache.org/thread.html/o1ojfn53742ztd13m93336t3kdjw2tq9

Published

Nov 1, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82552A security vulnerability has been detected in Linux Foundati…4.3
• CVE-2026-82553A vulnerability was detected in sambitraj Student Management…6.3
• CVE-2026-82554A flaw has been found in SourceCodester Queue Management Sys…4.3
• CVE-2026-82555A vulnerability has been found in TOTOLINK N600R 4.3.0cu.786…3.7
• CVE-2026-82556A vulnerability was found in Forgejo up to 15.0.4. This issu…6.3
• CVE-2026-82557Missing authorization in Apache Wicket. org.apache.wicket.m…6.9
• CVE-2026-82559Insufficient session expiration in Apache Wicket. org.apach…2.3
• CVE-2026-8256A security vulnerability has been detected in Devs Palace ER…2.4
• CVE-2026-82560Pod::Text versions before 6.1.1 for Perl allow CPU and memor…7.5
• CVE-2026-82561Apache NiFi 1.5.0 through 2.11.0 provide REST API methods th…6.5
• CVE-2026-82562### Summary When `qs.parse` is called with `comma: true` …3.7
• CVE-2026-82563An attacker could impersonate the camera and place themselve…7.6