{"id":"CVE-2026-82558","kind":"vulnerability","aliases":["CVE-2026-82558"],"related":[],"title":"Apache Wicket: WebSocket handlers skip authorization checks on hidden components","description":"Missing authorization in Apache Wicket.\n\norg.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage() callbacks without checking whether the client may invoke the component the behavior is attached to. Wicket opens a single WebSocket connection per page, and a message received on it is delivered to every WebSocketBehavior of that page. For an Ajax behavior Wicket makes this check before invoking it, through Behavior#canCallListener(Component), which refuses a component that is not visible or not enabled, including one for which the IAuthorizationStrategy denies the RENDER or ENABLE action. A WebSocketBehavior attached to such a component, or to a child of one, therefore receives the client's text and binary messages, together with a WebSocketRequestHandler that writes back to that client, where an Ajax behavior on the same component would be refused.\n\nAn application is affected where it attaches a WebSocketBehavior that overrides onMessage() to a component that it hides, disables, or restricts through its IAuthorizationStrategy, for example with MetaDataRoleAuthorizationStrategy or the AuthorizeAction annotation. The client needs a session of their own and a page of their own that contains such a component: messages are delivered only to pages in the page store of the client's own session, so this gives no access to another user's session, page or connection. Messages pushed by the server are not affected.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 6.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","summary":"Apache Wicket's WebSocketBehavior calls its message handlers without the authorization check that Ajax behaviors get, so a WebSocketBehavior on a hidden or disabled component receives messages from the client. An attacker with a session of their own can send messages that reach the application's handler and get a response written back to them, where the same component would refuse an Ajax call.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-wicket","java","package","websocket"],"not_affected_if":["no-onmessage-override","no-websocket-behavior","server-push-only"],"how_to_check":"- Check the Wicket version in the project build file or lockfile against the affected ranges: 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0, or older unsupported releases from 6.0.0.\n- Search the code for `WebSocketBehavior` subclasses that override `onMessage()` and check whether they are attached to components hidden, disabled, or restricted by an `IAuthorizationStrategy`, such as `MetaDataRoleAuthorizationStrategy` or `@AuthorizeAction`.","fix":"- Upgrade Apache Wicket 8.x to `8.20.0`\n- Upgrade Apache Wicket 9.x to `9.25.0`\n- Upgrade Apache Wicket 10.x to `10.12.0`","status":"open","published_at":"2026-11-01T22:17:47+00:00","first_seen_at":"2026-11-01T22:22:23+00:00","triaged_at":"2026-11-01T22:22:56+00:00","updated_at":"2026-11-01T22:22:56+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-01T22:22:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Wicket 8.x to `8.20.0`\n- Upgrade Apache Wicket 9.x to `9.25.0`\n- Upgrade Apache Wicket 10.x to `10.12.0`","reach":"internet","title":"Apache Wicket: WebSocket handlers skip authorization checks on hidden components","impact":"low","summary":"Apache Wicket's WebSocketBehavior calls its message handlers without the authorization check that Ajax behaviors get, so a WebSocketBehavior on a hidden or disabled component receives messages from the client. An attacker with a session of their own can send messages that reach the application's handler and get a response written back to them, where the same component would refuse an Ajax call.","audience":"developers","category":"package","nicknames":[],"who_cares":["apache-wicket","java","websocket"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated client messages reach restricted component handlers and receive replies","analyst_note":"","how_to_check":"- Check the Wicket version in the project build file or lockfile against the affected ranges: 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0, or older unsupported releases from 6.0.0.\n- Search the code for `WebSocketBehavior` subclasses that override `onMessage()` and check whether they are attached to components hidden, disabled, or restricted by an `IAuthorizationStrategy`, such as `MetaDataRoleAuthorizationStrategy` or `@AuthorizeAction`.","plain_action":"","needs_analyst":false,"not_affected_if":["no-websocket-behavior","no-onmessage-override","server-push-only"],"who_is_affected":"Applications that use Wicket's native WebSocket support and attach a WebSocketBehavior that overrides onMessage() to a component that is hidden, disabled, or restricted through an authorization strategy. The client must have its own session and a page containing that component; messages stay within the client's own session and page store. Applications without such behaviors, and those that only push messages from the server, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000849,"input_tokens":4611,"output_tokens":776,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-82558':13A,16A '10.0.0':333C '10.11.0':335C '10.12.0':355C '6.0.0':340C '8.0.0':325C '8.19.0':327C '8.20.0':352C '9.0.0':329C '9.24.0':331C '9.25.0':353C 'access':302C 'action':187C 'affect':234C,318C,321C,344C 'ajax':36B,85B,152C,222C 'also':343C 'annot':262C 'anoth':304C 'apach':1A,18B,23B,90C,322C 'apache-wicket':17B 'applic':67B,109C,232C 'attach':126C,190C,237C 'attack':54B 'author':6A,33B,88C 'authorizeact':261C 'back':75B,216C 'behavior':37B,124C,153C,162C,223C 'binari':208C 'call':27B,86B,110C 'callback':113C 'cancalllisten':163C 'check':7A,34B,115C,157C 'child':198C 'client':52B,106C,118C,204C,219C,264C,294C 'compon':10A,47B,81B,122C,164C,168C,194C,227C,245C,281C 'connect':133C,310C 'contain':278C 'cve':11A,14A 'deliv':143C,284C 'deni':182C 'disabl':46B,249C 'enabl':175C,186C 'everi':145C 'exampl':256C 'fix':357C 'get':38B,71B 'give':300C 'hand':100C 'handler':4A,30B,69B 'hidden':9A,44B 'hide':248C 'iauthorizationstrategi':181C,254C 'includ':176C 'invok':120C,159C 'issu':320C,359C 'java':20B 'make':155C 'may':119C 'messag':29B,49B,63B,102C,138C,209C,282C,311C 'metadataroleauthorizationstrategi':258C 'miss':87C 'nativ':97C 'need':265C 'older':336C 'one':177C,200C 'onmessag':112C,242C 'onward':341C 'open':129C 'org.apache.wicket.protocol.ws.api.websocketbehavior':92C 'overrid':241C 'packag':21B 'page':135C,149C,273C,287C,290C,308C 'per':134C 'push':312C 'reach':65B 'receiv':48B,139C,202C 'recommend':347C 'refus':83B,166C,230C 'releas':338C 'render':184C 'respons':73B 'restrict':251C 'send':62B 'sent':103C 'server':315C 'session':57B,267C,297C,307C 'singl':131C 'skip':5A 'store':291C 'support':99C 'text':206C 'therefor':201C 'togeth':210C 'unsupport':337C 'upgrad':349C 'user':305C,345C 'version':351C 'visibl':172C 'websocket':3A,22B,98C,132C 'websocketbehavior':26B,41B,146C,189C,239C 'websocketrequesthandl':213C 'whether':116C 'wicket':2A,19B,24B,91C,95C,128C,154C,323C 'without':31B,114C 'would':82B,228C 'write':215C 'written':74B","nicknames":[],"mitigations":[],"who_affected":"Applications that use Wicket's native WebSocket support and attach a WebSocketBehavior that overrides onMessage() to a component that is hidden, disabled, or restricted through an authorization strategy. The client must have its own session and a page containing that component; messages stay within the client's own session and page store. Applications without such behaviors, and those that only push messages from the server, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T22:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82558","severity":null,"published_at":"2026-11-01T22:17:47+00:00","modified_at":"2026-11-01T22:17:47+00:00","first_seen_at":"2026-11-01T22:22:23+00:00","fetched_at":"2026-11-01T22:22:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}