CVE-2026-82115 Apache Software Foundation CVE debrief

Who should care

Defenders of Apache Wicket applications should assess exposure and prioritize upgrading to version 8.20.0, 9.25.0, or 10.12.0. As a workaround, reject unauthorized connections with an IWebSocketConnectionFilter registered through WebSocketSettings#setConnectionFilter(), or repeat the authorization check at the start of each callback.

Why it matters

The missing authorization vulnerability in Apache Wicket's native WebSocket support allows unauthorized access to shared resources. Defenders should prioritize upgrading or applying workarounds to prevent potential attacks.

• An attacker can access shared resources without authorization
• An attacker can execute callbacks with a text or binary message of their choosing
• Defenders need to verify if their application is affected and prioritize upgrading or applying workarounds

Technical summary

The WebSocketMessageBroadcastHandler in Apache Wicket does not consult the IAuthorizationStrategy#isResourceAuthorized() method, allowing unauthorized access to shared resources. An attacker needs a bound Wicket session and the name of the resource, which is not a secret. This vulnerability affects Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. Defenders should prioritize upgrading to version 8.20.0, 9.25.0, or 10.12.0. As a workaround, reject unauthorized connections with an IWebSocketConnectionFilter registered through WebSocketSettings#setConnectionFilter(), or repeat the authorization check at the start of each callback.

Defensive priority

Defenders should prioritize upgrading to version 8.20.0, 9.25.0, or 10.12.0. As a workaround, reject unauthorized connections with an IWebSocketConnectionFilter registered through WebSocketSettings#setConnectionFilter(), or repeat the authorization check at the start of each callback.

Recommended defensive actions

• Upgrade to version 8.20.0, 9.25.0, or 10.12.0
• Reject unauthorized connections with an IWebSocketConnectionFilter registered through WebSocketSettings#setConnectionFilter()
• Repeat the authorization check at the start of each callback
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the WebSocketMessageBroadcastHandler not consulting the IAuthorizationStrategy#isResourceAuthorized() method. This allows unauthorized access to shared resources. The attacker needs a bound Wicket session and the name of the resource, which is not a secret.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.