Is CVE-2026-82557 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82557 being exploited in the wild.

How severe is CVE-2026-82557?

Informational severity, published 1 November 2026.

Which products and versions are affected?

Apache Wicket 10.3.0 through 10.11.0.

Is there a fix for CVE-2026-82557?

Yes: fixed in 10.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82557 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82557?

Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82557: Apache Wicket missing authorization in form submission

CVE-2026-82557 · Severity: info · Published 2026-11-01

Apache Wicket is a Java web application framework. A vulnerability in its form handling allows attackers to invoke hidden or disabled form buttons that the application intentionally withheld from users. An attacker who holds a form can craft requests to trigger actions on buttons they should not have access to, potentially causing unauthorized state changes or information disclosure.

Technologies: Apache Wicket. Vendors: Apache.

Quick answers

Is CVE-2026-82557 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82557 being exploited in the wild.
How severe is CVE-2026-82557?: Informational severity, published 1 November 2026.
Which products and versions are affected?: Apache Wicket 10.3.0 through 10.11.0.
Is there a fix for CVE-2026-82557?: Yes: fixed in 10.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82557 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82557?: Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 10.12.0

Technical details

The Form component resolves the submitting button from request parameters and invokes its onSubmit() callback without checking whether the button is visible or enabled in the component hierarchy. The authorization check that normally validates visibility and enablement only runs when no submitter is provided. An attacker can submit a form naming a disabled button's input name to bypass visibility, enablement, or authorization strategy restrictions (MetaDataRoleAuthorizationStrategy, AuthorizeAction) applied to that button. Ajax-based submissions are unaffected as they invoke authorization checks on the button itself.

Affected products

Apache Wicket 10.3.0 through 10.11.0

Timeline

2026-11-01: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.