Threats tagged 'ghsa-r953-8335-p3v2'

Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 contain a missing authorization check in WebSocketBehavior. This flaw allows client messages to be delivered to components that are hidden, disabled, or restricted by authorization strategies, bypassing intended access controls. The issue affects only the client's own session and pages, not other users' sessions or connections. Server-pushed messages are not impacted. Fixed versions are 8.20.0, 9.25.0, and 10.12.0.