CVE-2026-82705

Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized(), and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource reached through a mounted or shared ResourceReference. Components that are handed an org.apache.wicket.request.resource.IResource instance instead call IResource#respond() themselves from their own request listener and never construct that handler. In wicket-core these are org.apache.wicket.markup.html.link.ResourceLink, org.apache.wicket.markup.html.image.Image and org.apache.wicket.markup.html.form.ImageButton; in wicket-extensions it is org.apache.wicket.extensions.ajax.AjaxDownloadBehavior. A resource restricted by a custom isResourceAuthorized() implementation, or by an @AuthorizeResource annotation from wicket-auth-roles, is therefore enforced when it is requested through its own resource URL and is not enforced when the same instance is served through the component that holds it. Which of the two happens is decided by the constructor the application used, and not by anything the application can see in the rendered page. ResourceLink(String, ResourceReference) renders a resource URL and the request is authorized; ResourceLink(String, IResource) renders a component listener URL and it is not. Image, ImageButton and AjaxDownloadBehavior each offer the same pair of constructors and behave the same way. Image and ImageButton write that listener URL into the src attribute of the tag they render, so a browser requests it without any action by the user, and the resource an Image serves may also come from the component's model. An application is affected where it restricts a resource through IAuthorizationStrategy#isResourceAuthorized() or an @AuthorizeResource annotation and then hands that same resource to one of those components as an IResource. An application that does not restrict resources at all is not affected, and neither is a resource that is only mounted or registered as a shared resource. The pattern does not have to be written by the application itself: org.apache.wicket.extensions.markup.html.repeater.data.table.export.ExportToolbar builds each of its export links from an IResource instance, so the exported contents of a data table are served without the resource check in any application that adds that toolbar. As a workaround, register the resource in the application's shared resources and pass the resulting ResourceReference to the component instead of the IResource, so that the request is routed through the handler that consults the authorization strategy. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.

• CWE-862

• https://lists.apache.org/thread.html/t9y3sho3wkqkr1vsf74xn8tzmgdr1tgo

Published

Nov 1, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8270A vulnerability was determined in Open5GS up to 2.7.7. The a…6.5
• CVE-2026-82700A vulnerability was found in code-projects Online Shopping S…4.3
• CVE-2026-82701A vulnerability was determined in code-projects Online Shopp…7.3
• CVE-2026-82702A vulnerability was identified in Edimax BR-6214K 1.40. This…6.6
• CVE-2026-82703A security flaw has been discovered in Edimax BR-6214K 1.40.…6.6
• CVE-2026-82704Missing authorization in Apache Wicket. org.apache.wicket.c…6.9
• CVE-2026-82708The Botslab G980H dash camera firmware contains a path trave…6.5
• CVE-2026-8271A vulnerability was identified in D-Link DNS-320 2.06B01. Th…7.2
• CVE-2026-82710Improper Neutralization of Escape, Meta, or Control Sequence…2.3
• CVE-2026-82712Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior ar…8.8
• CVE-2026-82715Insecure Temporary File vulnerability in Hitachi Disk Array …7.9
• CVE-2026-82716The Botslab G980H dash camera firmware includes sensitive co…4.6