Apache Wicket up to 10.11.0 Form Submission Form.java Form.onRequest improper authorization

Summaryinfo

A vulnerability was found in Apache Wicket. It has been declared as critical. This impacts the function Form.onRequest of the file Form.java of the component Form Submission. Such manipulation leads to improper authorization. This vulnerability is referenced as CVE-2026-82557. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Apache Wicket. Affected by this issue is the function Form.onRequest of the file Form.java of the component Form Submission. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Missing authorization in Apache Wicket. org.apache.wicket.markup.html.form.Form resolves the component that submitted a form from the request parameters in Form#onRequest() and passes the result directly to Form#onFormSubmitted(IFormSubmitter). The check that the submitting component is visible and enabled in its hierarchy runs only when onFormSubmitted() is given no submitter, so it no longer runs for an ordinary form submission, and it is the only point at which Wicket verifies that the application actually offered the named control to the caller. Form#findSubmitter() matches on the request parameter name alone and applies no visibility or enablement filter, and the request handler checks only the form itself, which is visible and enabled. A request that names a submit button the application withheld therefore reaches that button's onSubmit() and onAfterSubmit(), and its onError() when form validation fails; where the button sets setDefaultFormProcessing(false) it reaches onSubmit() and onAfterSubmit() without any form validation. An application is affected where a form submitting component, such as a Button or a SubmitLink, is unavailable to the caller while the enclosing form remains available. How the component was made unavailable does not matter: the component's own setVisible(false), setEnabled(false) or setVisibilityAllowed(false), an overridden isVisible() or isEnabled(), an invisible or disabled parent container anywhere above it, and a RENDER or ENABLE denial from IAuthorizationStrategy — for example through MetaDataRoleAuthorizationStrategy or the AuthorizeAction annotation — are all enforced by that one check, and all of them are bypassed. A component that renders as disabled carries its own input name in the markup the caller already holds. Submissions made through AjaxFormSubmitBehavior, and therefore through AjaxButton and AjaxSubmitLink, are not affected: those are invoked as a behaviour on the button itself, the behaviour's invocation is authorized against that button, and the non-Ajax callbacks of those two classes do nothing. Restrictions applied to the form or to the page rather than to the submitting component are unaffected. The 9.x and 8.x release lines, and the unsupported lines before them, are not affected; the behaviour was introduced in 10.3.0. This issue affects Apache Wicket: from 10.3.0 through 10.11.0. Users are recommended to upgrade to version 10.12.0, which fixes the issue.

The advisory is shared for download at lists.apache.org. This vulnerability is handled as CVE-2026-82557 since 08/29/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/02/2026). The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 10.12.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-114887). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Apache

Name

• Wicket

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6
• 1.4.7
• 1.4.8
• 1.4.9
• 1.4.10
• 1.4.11
• 1.4.12
• 1.4.13
• 1.4.14
• 1.4.15
• 1.4.16
• 1.4.17
• 1.4.18
• 1.4.19
• 1.4.20
• 1.4.21
• 1.4.22
• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.4
• 1.5.5
• 1.5.6
• 1.5.7
• 1.5.8
• 1.5.9
• 1.5.10
• 1.5.12
• 1.5.13
• 1.5.15
• 1.5.17
• 6.0.0
• 6.1.0
• 6.1.1
• 6.2.0
• 6.3
• 6.3.0
• 6.4.0
• 6.5.0
• 6.6.0
• 6.7.0
• 6.8.0
• 6.9.0
• 6.10.0
• 6.11.0
• 6.12.0
• 6.13.0
• 6.14.0
• 6.15.0
• 6.16
• 6.16.0
• 6.17.0
• 6.18
• 6.18.0
• 6.19.0
• 6.20.0
• 6.21
• 6.21.0
• 6.22.0
• 6.23.0
• 6.24.0
• 6.25.0
• 7.0.0
• 7.0.0-M2
• 7.0.0-M3
• 7.0.0-M4
• 7.0.0-M5
• 7.1
• 7.1.0
• 7.2.0
• 7.3.0
• 7.4.0
• 7.5.0
• 7.10.1
• 7.16.0
• 8.0.0-M1
• 8.0.0-M2
• 8.0.0-M9.1
• 8.8.0
• 8.11.0
• 8.16
• 8.16.0
• 8.17.0
• 8.20.0
• 9.0.0-M5
• 9.2.0
• 9.17.0
• 9.18
• 9.18.0
• 9.19.0
• 9.21
• 9.22.0
• 9.24.0
• 9.25.0
• 10.0.0
• 10.1.0
• 10.2
• 10.3.0
• 10.7
• 10.8.0
• 10.9.0
• 10.10.0
• 10.11.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion