CVE-2026-82557 Apache Software Foundation CVE debrief

Who should care

Defenders of Apache Wicket applications should assess exposure of form submitting components and verify authorization of form submissions. This includes developers and administrators of Apache Wicket applications who need to ensure that form submitting components are properly authorized and that the enclosing form remains available.

Why it matters

Defenders should care about this vulnerability as it allows unauthorized form submissions in Apache Wicket applications, potentially leading to security issues. Roles that should assess exposure include developers and administrators of Apache Wicket applications. The supported consequences include potential unauthorized form submissions and bypass of authorization checks. Evidence limits include the lack of information on actual exploitation and affected versions prior to 10.3.0 and after 10.11.0.

• Potential unauthorized form submissions
• Bypass of authorization checks for form submitting components
• Possible exploitation of vulnerable components

Technical summary

The vulnerability is caused by the Form#onRequest() method in Apache Wicket, which resolves the component that submitted a form from the request parameters and passes the result directly to Form#onFormSubmitted(IFormSubmitter). The check for the submitting component being visible and enabled in its hierarchy only runs when onFormSubmitted() is given no submitter, bypassing the check for ordinary form submissions.

Defensive priority

Upgrade to version 10.12.0 and assess exposure of form submitting components.

Recommended defensive actions

• Upgrade to Apache Wicket version 10.12.0
• Assess exposure of form submitting components
• Verify authorization of form submissions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD vulnerability detail provide information on the missing authorization issue in Apache Wicket. Evidence limits include the lack of information on actual exploitation and affected versions prior to 10.3.0 and after 10.11.0. The vulnerability allows unauthorized form submissions in Apache Wicket applications, potentially leading to security issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.