Missing Authorization in Apache Wicket WebSocket Support

CVE-2026-82115

What is CVE-2026-82115?

A vulnerability exists in Apache Wicket's WebSocket implementation that allows unauthorized access to shared resources. Specifically, the request handler for WebSocket messages does not properly consult the authorization strategy, enabling attackers to send arbitrary messages without appropriate permissions. This issue affects applications that expose a WebSocketResource and rely on authorization for access control. Attackers with a valid Wicket session can exploit this flaw by crafting messages that trigger callbacks defined in the resource, potentially leading to unauthorized actions. To mitigate this risk, it is recommended to implement an IWebSocketConnectionFilter or add authorization checks in callback methods. Users should upgrade to the latest patched versions to safeguard against this vulnerability.

References