Apache Wicket Fixes Authorization, Session, Upload, and XSS Flaws
Tech GuruP1 — VALIDATE AND UPDATELow to High · 2.1-8.3 (CVSS v4.0; CVE-specific)EXPLOITATION: NOT STATED
Quick Answer
Application owners should map deployed Wicket components and feature use to the 19 advisories, upgrade the affected branch to 8.20.0, 9.25.0 or 10.12.0, and test authorization, session renewal, uploads and output encoding.
Confirm Scope And Apply The Supported Remediation
What to do now: Record Wicket Maven dependencies, deployed application builds, WebSocket resources, authorization strategies, upload handlers, resource bundles and custom request-handler delegates. Use the per-CVE ranges below and the linked prerequisites. For example, the CSP issue concerns nested request-handler delegates; the session-fixation issue starts in specific later minor releases. Upgrade all affected Wicket components together on the application-supported fixed branch and redeploy. For WebSocket resources pending upgrade, Apache describes connection filtering or explicit callback authorization as a temporary measure. Verify deployed dependency versions, unauthorized-resource denial, WebSocket authorization after logout, session-id renewal, upload limits, rendered output and CSP headers; retain build, access-test and deployment evidence.
Last verified: 2026-11-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Apache Wicket core, extensions, auth-roles and native WebSocket components |
|---|---|
| Advisory | CVE-2026-82115 / CVE-2026-82557 / CVE-2026-82558 / CVE-2026-82559 / CVE-2026-82704 / CVE-2026-82705 / CVE-2026-82840 / CVE-2026-82898 / CVE-2026-82956 / CVE-2026-83539 / CVE-2026-83559 / CVE-2026-83594 / CVE-2026-84170 / CVE-2026-84172 / CVE-2026-84177 / CVE-2026-84231 / CVE-2026-87718 / CVE-2026-95863 / CVE-2026-111089 |
| CVEs | CVE-2026-111089, CVE-2026-82115, CVE-2026-82557, CVE-2026-82558, CVE-2026-82559, CVE-2026-82704, CVE-2026-82705, CVE-2026-82840, CVE-2026-82898, CVE-2026-82956, CVE-2026-83539, CVE-2026-83559, CVE-2026-83594, CVE-2026-84170, CVE-2026-84172, CVE-2026-84177, CVE-2026-84231, CVE-2026-87718, CVE-2026-95863 |
| Authoritative release date | 2026-11-01T21:29:08Z (latest of the 19 Apache announcements; individual times below) |
| Authority revision date | No later revision is stated in the captured Apache announcements. |
| Affected versions | Issue-specific Wicket 8, 9 and 10 release ranges shown below; not every application or branch is affected by every CVE. |
| Fixed version | Apache Wicket 8.20.0, 9.25.0 or 10.12.0, according to the affected component and supported application branch |
| CVSS base score | 2.1-8.3 (CVSS v4.0; CVE-specific) |
| CVSS severity | Low to High |
| Exploitation status | The Apache advisories do not state that these issues have been maliciously exploited.; no exploitation claim is inferred. |
Authority-Specific Scope And Version Evidence
| CVE-2026-82115 | - Apache Wicket (org.apache.wicket:wicket-native-websocket-core) 8.0.0 through 8.19.0 - Apache Wicket (org.apache.wicket:wicket-native-websocket-core) 9.0.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-native-websocket-core) 10.0.0 through 10.11.0. Published 2026-11-01T21:20:02Z. CVSS v4.0 6.3; Medium. |
|---|---|
| CVE-2026-82557 | - Apache Wicket (org.apache.wicket:wicket-core) 10.3.0 through 10.11.0. Published 2026-11-01T21:20:19Z. CVSS v4.0 6.9; Medium. |
| CVE-2026-82558 | - Apache Wicket (org.apache.wicket:wicket-native-websocket-core) 8.0.0 through 8.19.0 - Apache Wicket (org.apache.wicket:wicket-native-websocket-core) 9.0.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-native-websocket-core) 10.0.0 through 10.11.0. Published 2026-11-01T21:20:31Z. CVSS v4.0 2.3; Low. |
| CVE-2026-82559 | - Apache Wicket (org.apache.wicket:wicket-native-websocket-core) 8.0.0 through 8.19.0 - Apache Wicket (org.apache.wicket:wicket-native-websocket-core) 9.0.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-native-websocket-core) 10.0.0 through 10.11.0. Published 2026-11-01T21:20:42Z. CVSS v4.0 2.3; Low. |
| CVE-2026-82704 | - Apache Wicket (org.apache.wicket:wicket-core) 8.0.0 through 8.19.0 - Apache Wicket (org.apache.wicket:wicket-core) 9.0.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.11.0. Published 2026-11-01T21:20:54Z. CVSS v4.0 6.9; Medium. |
| CVE-2026-82705 | - Apache Wicket (org.apache.wicket:wicket-core) 8.0.0 through 8.19.0 - Apache Wicket (org.apache.wicket:wicket-core) 9.0.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.11.0. Published 2026-11-01T21:21:06Z. CVSS v4.0 6.3; Medium. |
| CVE-2026-82840 | - Apache Wicket (org.apache.wicket:wicket-auth-roles) 8.18.0 through 8.19.0 - Apache Wicket (org.apache.wicket:wicket-auth-roles) 9.23.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-auth-roles) 10.9.0 through 10.11.0. Published 2026-11-01T21:21:18Z. CVSS v4.0 7.2; High. |
| CVE-2026-82898 | - Apache Wicket (org.apache.wicket:wicket-core) 9.1.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.11.0. Published 2026-11-01T21:21:33Z. CVSS v4.0 2.1; Low. |
| CVE-2026-82956 | - Apache Wicket (org.apache.wicket:wicket-core) 8.0.0 through 8.19.0 - Apache Wicket (org.apache.wicket:wicket-core) 9.0.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.11.0. Published 2026-11-01T21:21:45Z. CVSS v4.0 7.6; High. |
| CVE-2026-83539 | - Apache Wicket (org.apache.wicket:wicket-extensions) 8.0.0 through 8.19.0 - Apache Wicket (org.apache.wicket:wicket-extensions) 9.0.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-extensions) 10.0.0 through 10.11.0. Published 2026-11-01T21:21:59Z. CVSS v4.0 7.4; High. |
| CVE-2026-83559 | - Apache Wicket (org.apache.wicket:wicket-core) 8.0.0 through 8.19.0 - Apache Wicket (org.apache.wicket:wicket-core) 9.0.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.11.0. Published 2026-11-01T21:22:10Z. CVSS v4.0 7.4; High. |
| CVE-2026-83594 | - Apache Wicket (org.apache.wicket:wicket-core) 9.14.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.11.0. Published 2026-11-01T21:22:31Z. CVSS v4.0 8.3; High. |
| CVE-2026-84170 | - Apache Wicket (org.apache.wicket:wicket-core) 9.14.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.9.1. Published 2026-11-01T21:22:52Z. CVSS v4.0 8.3; High. |
| CVE-2026-84172 | - Apache Wicket (org.apache.wicket:wicket-core) 8.0.0 through 8.19.0 - Apache Wicket (org.apache.wicket:wicket-core) 9.0.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.11.0. Published 2026-11-01T21:23:11Z. CVSS v4.0 6.3; Medium. |
| CVE-2026-84177 | - Apache Wicket (org.apache.wicket:wicket-core) 8.0.0 through 8.19.0 - Apache Wicket (org.apache.wicket:wicket-core) 9.0.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.11.0. Published 2026-11-01T21:23:28Z. CVSS v4.0 6.3; Medium. |
| CVE-2026-84231 | - Apache Wicket (org.apache.wicket:wicket-core) 8.0.0 through 8.19.0. Published 2026-11-01T21:23:46Z. CVSS v4.0 7.4; High. |
| CVE-2026-87718 | - Apache Wicket (org.apache.wicket:wicket-core) 9.24.0 - Apache Wicket (org.apache.wicket:wicket-core) 10.10.0 through 10.11.0. Published 2026-11-01T21:24:42Z. CVSS v4.0 2.3; Low. |
| CVE-2026-95863 | - Apache Wicket 8.0.0 through 8.19.0 - Apache Wicket 9.0.0 through 9.24.0 - Apache Wicket 10.0.0 through 10.11.0. Published 2026-11-01T21:25:44Z. CVSS v4.0 7.6; High. |
| CVE-2026-111089 | - Apache Wicket 8.0.0 through 8.19.0 - Apache Wicket 9.0.0 through 9.24.0 - Apache Wicket 10.0.0 through 10.11.0. Published 2026-11-01T21:29:08Z. CVSS v4.0 7.6; High. |
What Changed
Apache published 19 Wicket advisories covering authorization enforcement, session handling, uploads, markup disclosure, cross-site scripting and missing CSP headers.
What To Validate Now
- Inventory. Record Wicket Maven dependencies, deployed application builds, WebSocket resources, authorization strategies, upload handlers, resource bundles and custom request-handler delegates.
- Establish applicability. Use the per-CVE ranges below and the linked prerequisites. For example, the CSP issue concerns nested request-handler delegates; the session-fixation issue starts in specific later minor releases.
- Remediate. Upgrade all affected Wicket components together on the application-supported fixed branch and redeploy. For WebSocket resources pending upgrade, Apache describes connection filtering or explicit callback authorization as a temporary measure.
- Validate. Verify deployed dependency versions, unauthorized-resource denial, WebSocket authorization after logout, session-id renewal, upload limits, rendered output and CSP headers; retain build, access-test and deployment evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Test custom authorization and request-handler behavior. Do not assume UI visibility alone enforces authorization or that every Wicket application is exposed to every issue. Older unsupported branches require a supported migration plan.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
- CVE-2026-82115
- CVE-2026-82557
- CVE-2026-82558
- CVE-2026-82559
- CVE-2026-82704
- CVE-2026-82705
- CVE-2026-82840
- CVE-2026-82898
- CVE-2026-82956
- CVE-2026-83539
- CVE-2026-83559
- CVE-2026-83594
- CVE-2026-84170
- CVE-2026-84172
- CVE-2026-84177
- CVE-2026-84231
- CVE-2026-87718
- CVE-2026-95863
- CVE-2026-111089
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
