CVE-2026-71378: CWE-352 Cross-Site Request Forgery (CSRF) in Apache Software Foundation Apache Wicket

The vulnerability arises from the FetchMetadataResourceIsolationPolicy in Apache Wicket, which permits every "simple top-level navigation" and unconditionally allows same-site requests from sibling origins. This allows cross-site GET navigations and same-site POST form submits to invoke component listeners (such as Link.onClick() and form submits) within the victim's authenticated session, leveraging browser behavior that sends cookies on such requests. The flaw enables CSRF attacks where an attacker can cause actions to be executed with the victim's privileges. The vulnerability affects Apache Wicket versions 9.1.0 through 9.23.0 and 10.0.0 through 10.10.0. Releases before 9.1.0, including all 8.x versions, are not affected. Upgrading to Apache Wicket 9.24.0 or 10.11.0 mitigates the issue.

An attacker can exploit this vulnerability to perform unauthorized actions on behalf of an authenticated user by triggering component listeners through crafted cross-site or same-site requests. This can lead to limited confidentiality and integrity impacts within the context of the affected application, as indicated by the CVSS vector (Confidentiality and Integrity partial impact, no availability impact).

Users should upgrade to Apache Wicket version 9.24.0 or later, or 10.11.0 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is not explicitly stated in the input but the recommendation to upgrade to these versions indicates an official fix is available.