Threats tagged 'ghsa-fcp8-rfgx-8mhm'

Apache Wicket versions 7.0.0 and later through 8.19.0, 9.24.0, and 10.11.0 contain a missing authorization check in the native WebSocket support. The WebSocketMessageBroadcastHandler directly invokes resource callbacks without consulting the configured authorization strategy, allowing authenticated users to access WebSocketResource callbacks without proper authorization enforcement. This can lead to unauthorized use of WebSocket resources if the application relies solely on the authorization strategy to restrict access. Fixed in versions 8.20.0, 9.25.0, and 10.12.0.