# CVE-2026-82557: Apache Wicket missing authorization in form submission

Source: https://junglewise.ai/threats/cve-2026-82557-missing-authorization-in-apache-wicket-org-apache-wicket-markup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-82557 · Severity: info · Published 2026-11-01

Apache Wicket is a Java web application framework. A vulnerability in its form handling allows attackers to invoke hidden or disabled form buttons that the application intentionally withheld from users. An attacker who holds a form can craft requests to trigger actions on buttons they should not have access to, potentially causing unauthorized state changes or information disclosure.

Technologies: [Apache Wicket](https://junglewise.ai/threats/technologies/apache-wicket). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82557 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82557 being exploited in the wild.

**How severe is CVE-2026-82557?** Informational severity, published 1 November 2026.

**Which products and versions are affected?** Apache Wicket 10.3.0 through 10.11.0.

**Is there a fix for CVE-2026-82557?** Yes: fixed in 10.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82557 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82557?** Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.12.0

## Technical details

The Form component resolves the submitting button from request parameters and invokes its onSubmit() callback without checking whether the button is visible or enabled in the component hierarchy. The authorization check that normally validates visibility and enablement only runs when no submitter is provided. An attacker can submit a form naming a disabled button's input name to bypass visibility, enablement, or authorization strategy restrictions (MetaDataRoleAuthorizationStrategy, AuthorizeAction) applied to that button. Ajax-based submissions are unaffected as they invoke authorization checks on the button itself.

## Affected products

- Apache Wicket 10.3.0 through 10.11.0

## Timeline

- 2026-11-01: disclosed

## Related threats

- [Apache Wicket improper input neutralization in JavaScript generation](https://junglewise.ai/threats/cve-2026-95863-improper-neutralization-of-input-during-web-page-generation-in)
- [Apache Wicket missing Content-Security-Policy headers with nested request handler delegates](https://junglewise.ai/threats/cve-2026-87718-apache-wicket-10-10-0-10-11-0-and-9-24-0-do-not-set-the-content)
- [Apache Wicket ExternalLink reflected XSS in onclick attribute](https://junglewise.ai/threats/cve-2026-84231-improper-neutralization-of-input-during-web-page-generation-in)
- [Apache Wicket path validation bypass in package resource handling](https://junglewise.ai/threats/cve-2026-84177-incorrect-behavior-order-in-apache-wicket-a-file-path-is)
- [Apache Wicket template disclosure via class loader misconfiguration](https://junglewise.ai/threats/cve-2026-84172-files-accessible-to-external-parties-in-apache-wicket-org-apache)