CVE-2026-82558
Received Received - Intake

Missing Authorization in Apache Wicket WebSocketBehavior

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Apache Software Foundation

Description
Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage() callbacks without checking whether the client may invoke the component the behavior is attached to. Wicket opens a single WebSocket connection per page, and a message received on it is delivered to every WebSocketBehavior of that page. For an Ajax behavior Wicket makes this check before invoking it, through Behavior#canCallListener(Component), which refuses a component that is not visible or not enabled, including one for which the IAuthorizationStrategy denies the RENDER or ENABLE action. A WebSocketBehavior attached to such a component, or to a child of one, therefore receives the client's text and binary messages, together with a WebSocketRequestHandler that writes back to that client, where an Ajax behavior on the same component would be refused. An application is affected where it attaches a WebSocketBehavior that overrides onMessage() to a component that it hides, disables, or restricts through its IAuthorizationStrategy, for example with MetaDataRoleAuthorizationStrategy or the AuthorizeAction annotation. The client needs a session of their own and a page of their own that contains such a component: messages are delivered only to pages in the page store of the client's own session, so this gives no access to another user's session, page or connection. Messages pushed by the server are not affected. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 6.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-82558

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization check in Apache Wicket's WebSocket support. When a WebSocketBehavior is attached to a component that should be restricted (e.g., hidden or disabled via IAuthorizationStrategy), the component still receives client messages without proper validation. This allows unauthorized access to WebSocketBehavior callbacks for restricted components.

Detection Guidance

This vulnerability is specific to Apache Wicket and involves missing authorization checks in WebSocketBehavior. Detection requires checking if your application uses Wicket versions 8.0.0-8.19.0, 9.0.0-9.24.0, or 10.0.0-10.11.0. Inspect your project dependencies for these versions. No direct network commands detect this, but verify if WebSocketBehavior components are attached to restricted components.

Impact Analysis

An attacker with a valid session could send messages to WebSocketBehavior callbacks on components they should not access. This could lead to unintended data processing or responses, but does not grant access to other users' sessions or pages. The impact is limited to the attacker's own session and pages.

Compliance Impact

This vulnerability may violate compliance requirements that mandate strict access controls and authorization checks, such as GDPR's data protection principles or HIPAA's access controls. Unauthorized message processing could lead to improper data handling, potentially violating regulatory obligations.

Mitigation Strategies

Upgrade Apache Wicket to version 8.20.0, 9.25.0, or 10.12.0 or later to fix the missing authorization issue in WebSocketBehavior.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82558. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...