CVE-2026-43646 | Apache Wicket up to 8.16.x/9.21.x/10.7.x PackageResourceGuard access control

A vulnerability marked as critical has been reported in Apache Wicket up to 8.16.x/9.21.x/10.7.x. Affected by this vulnerability is an unknown functionality of the component PackageResourceGuard. The manipulation leads to improper access controls.

This vulnerability is referenced as CVE-2026-43646. Remote exploitation of the attack is possible. No exploit is available.

It is suggested to upgrade the affected component.