Threats tagged 'ghsa-6m6x-fvwc-5g3p'

CVE-2026-82704 is a missing authorization vulnerability in Apache Wicket affecting versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. The flaw allows invocation of component listeners without proper authorization checks when a listener URL omits the page identifier, causing the component's visibility and enablement flags to be incorrectly set. This can lead to unauthorized execution of component listeners, including AJAX behaviors, on newly constructed page instances. The issue is fixed in versions 8.20.0, 9.25.0, and 10.12.0.