Missing Authorization in Apache Wicket Affects Web Applications

CVE-2026-82557

What is CVE-2026-82557?

A security vulnerability in Apache Wicket allows unauthorized users to submit forms without adequate validation. Specifically, the framework fails to validate the visibility and enablement of form components when processing submissions. This flaw enables an attacker to exploit buttons or links rendered as disabled or invisible within a form, allowing unauthorized submissions to trigger backend logic, bypassing security mechanisms. This issue affects versions from 10.3.0 to 10.11.0, and users are urged to upgrade to version 10.12.0, which addresses this vulnerability.

References