CVE-2026-82115
Received Received - Intake

Missing Authorization in Apache Wicket WebSocket Handling

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Apache Software Foundation

Description
Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request handler Wicket's native WebSocket support uses to deliver an incoming frame, resolves the shared resource named by the client's handshake parameter and calls WebSocketResource#onPayload() on it directly, without consulting IAuthorizationStrategy#isResourceAuthorized(). That method has a single enforcement point in the framework, org.apache.wicket.request.handler.resource.ResourceRequestHandler, which the WebSocket transport does not pass through, and WebSocketResource#respond() is final and empty. No route to a WebSocketResource therefore asks the configured authorization strategy whether the caller may use it, and an @AuthorizeResource annotation on such a class has no effect. A caller needs a bound Wicket session and the name of the resource. The name is not a secret: Wicket writes it into the page that opens the connection. No page of the application is otherwise involved, because a request naming a resource is served with a throwaway page. All of the resource's callbacks are reached this way, including onConnect() and both onMessage() overloads, and what a callback pushes back through WebSocketRequestHandler goes to the caller's own connection. An application is affected where it registers a WebSocketResource as a shared resource and relies on the authorization strategy to restrict it. What the caller gains is whatever that resource's callbacks do with a text or binary message of the caller's choosing. The connection is registered under the caller's own session, so it gives no access to another user's connection. As a workaround, reject unauthorized connections with an IWebSocketConnectionFilter registered through WebSocketSettings#setConnectionFilter(), or repeat the authorization check at the start of each callback. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 7.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-82115

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization check in Apache Wicket's WebSocket support. The WebSocketMessageBroadcastHandler does not consult the authorization strategy before allowing access to shared resources, bypassing @AuthorizeResource annotations and IAuthorizationStrategy checks. This allows unauthorized users with a valid Wicket session to interact with protected WebSocket resources.

Detection Guidance

Detecting this vulnerability requires checking Apache Wicket versions and WebSocket resource configurations. Inspect application logs for unauthorized WebSocket connections or unusual resource access patterns. No direct commands are provided in the context, but monitoring for unauthorized WebSocket resource usage is recommended.

Impact Analysis

An attacker could exploit this to send malicious messages to WebSocket resources, potentially gaining unauthorized access to sensitive functionality or data. The impact depends on the application's WebSocket resources but could include data theft, unauthorized actions, or service disruption. The attacker needs a valid session and the resource name, which may be exposed in page content.

Compliance Impact

This vulnerability allows unauthorized access to WebSocket resources due to missing authorization checks. For GDPR, it could lead to unauthorized data exposure or processing if the WebSocket resource handles personal data. For HIPAA, it may permit unauthorized access to protected health information if the resource processes such data. The lack of proper authorization violates principles of least privilege and data protection.

Mitigation Strategies

Upgrade Apache Wicket to version 8.20.0, 9.25.0, or 10.12.0. As a temporary workaround, implement an IWebSocketConnectionFilter via WebSocketSettings#setConnectionFilter() to reject unauthorized connections or add authorization checks at the start of each WebSocketResource callback.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82115. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...