Is CVE-2026-82115 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82115 being exploited in the wild.

How severe is CVE-2026-82115?

Informational severity, published 1 November 2026.

Which products and versions are affected?

Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0, and 7.0.0 onwards (unsupported).

How is CVE-2026-82115 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82115?

Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82115: Apache Wicket missing authorization in WebSocket handler

CVE-2026-82115 · Severity: info · Published 2026-11-01

Apache Wicket is a Java web application framework. A weakness in its WebSocket support allows an authenticated user to bypass authorization checks and invoke WebSocket resource callbacks without proper permission verification. An attacker with a valid session can send arbitrary messages to WebSocket resources that should be restricted, potentially causing unauthorized actions or data exposure.

Technologies: Apache Wicket. Vendors: Apache.

Quick answers

Is CVE-2026-82115 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82115 being exploited in the wild.
How severe is CVE-2026-82115?: Informational severity, published 1 November 2026.
Which products and versions are affected?: Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0, and 7.0.0 onwards (unsupported).
Is there a fix for CVE-2026-82115?: Yes: fixed in 8.20.0, 9.25.0, 10.12.0. Until then: Register an IWebSocketConnectionFilter through WebSocketSettings#setConnectionFilter() to reject unauthorized connections, or repeat the authorization check at the start of each WebSocket resource callback. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82115 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82115?: Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.20.0, 9.25.0, 10.12.0

Register an IWebSocketConnectionFilter through WebSocketSettings#setConnectionFilter() to reject unauthorized connections, or repeat the authorization check at the start of each WebSocket resource callback.

Technical details

The WebSocketMessageBroadcastHandler in Apache Wicket resolves shared resources by name and invokes WebSocketResource#onPayload() without consulting IAuthorizationStrategy, bypassing the single authorization enforcement point in ResourceRequestHandler. An attacker with a bound Wicket session and knowledge of the resource name (leaked in the page source) can reach all resource callbacks including onConnect() and onMessage() overloads. The vulnerability affects applications registering WebSocketResource as a shared resource and relying on authorization annotations like @AuthorizeResource for access control.

Affected products

Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0, and 7.0.0 onwards (unsupported)

Timeline

2026-11-01: disclosed
2026-11-01: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.