CVE-2026-82704 Apache Software Foundation CVE debrief

Who should care

Defenders of Apache Wicket applications should assess their exposure, especially where individual components are withheld from callers through authorization strategies or visibility/enablement settings in Component#onConfigure().

Why it matters

The CVE-2026-82704 vulnerability in Apache Wicket allows unauthorized listener invocation, potentially leading to unintended actions. Defenders should assess exposure, verify authorization strategies, and adjust component settings to prevent exploitation.

• Verify authorization strategies for components to prevent unauthorized listener invocation
• Assess and adjust component visibility and enablement settings to prevent unintended actions
• Review page and component configurations to ensure proper authorization and access control

Technical summary

The vulnerability is caused by the org.apache.wicket.core.request.handler.ListenerRequestHandler invoking an IRequestListener without proper authorization checks. This happens when a page identifier is omitted from a listener URL, skipping the render phase and Component#configure() callback. As a result, listeners of components that the authorization strategy denied RENDER for may be executed. The vulnerability arises from missing authorization in Apache Wicket's ListenerRequestHandler, allowing listeners to be invoked without proper authorization checks. This occurs when a page identifier is omitted from a listener URL, bypassing the render phase and Component#configure() callback. Affected product deployments

Defensive priority

Upgrade to patched versions; assess exposed components and configurations

Recommended defensive actions

• Upgrade Apache Wicket to version 8.20.0, 9.25.0, or 10.12.0
• Assess and configure authorization strategies for components
• Review and adjust component visibility and enablement settings
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability arises from missing authorization in Apache Wicket's ListenerRequestHandler, allowing listeners to be invoked without proper authorization checks. This occurs when a page identifier is omitted from a listener URL, bypassing the render phase and Component#configure() callback.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.