Access control vulnerability in Apache Wicket affecting multiple versions

CVE-2026-84172

What is CVE-2026-84172?

An access control issue in Apache Wicket allows for the potential exposure of developer-authored template content via improperly configured class loaders. If the class loader for wicket-core cannot see the application's component classes, it can mistakenly serve static HTML files without proper authorization checks. This can lead to unintentional access to markup templates and other components, leaving sensitive structure information disclosed. The risk is primarily associated with deployments that provide a limited visibility of class loaders, such as those using shared libraries or certain configurations in application servers. Users are urged to update to supported versions to safeguard against this exposure.

References