Cross-Origin Resource Control Flaw in Apache Wicket Software

CVE-2026-82898

What is CVE-2026-82898?

The vulnerability in Apache Wicket arises from an incorrect sequence of security checks within the ResourceIsolationRequestCycleListener, where resource isolation policies are applied only after obtaining the targeted page. This allows unauthorized access to resources by exploiting the construction of exceptions thrown for unauthenticated visitors. Specifically, if an application employs RestartResponseAtInterceptPageException to control access, it unwittingly bypasses the established policies. The mitigation is to utilize RestartResponseException to prevent resuming requests with unauthorized parameters.

References