Authorization Bypass in Apache Wicket Affects Multiple Versions

CVE-2026-82705

What is CVE-2026-82705?

Apache Wicket is affected by a vulnerability that allows unauthorized access to resources due to missing authorization checks. This occurs when resources are handed to components incorrectly, bypassing security measures defined in the authorization strategy. Specifically, when a component uses an IResource instance directly, the authorization strategy may not be enforced, leading to potential data exposure. Applications that implement resource restrictions via IAuthorizationStrategy or @AuthorizeResource annotations are affected unless specific workarounds, such as utilizing shared resources, are employed. Users are advised to upgrade to the latest versions to mitigate this risk.

References