Apache Wicket CVE-2026-76983

Exploitation requires that the vulnerable Wicket application passes attacker-controllable data into a form component's label model via FormComponent#setLabel(IModel), and that a page containing that form component is rendered to another user's browser (stored XSS) or to the attacker's own browser in a reflected scenario. The AutoLabelTextResolver is registered by default in every WebApplication, so no special plugin or configuration is required on the framework side - the limiting factor is entirely the application's data-flow design. Applications where label models are populated exclusively from static strings, resource bundles, or fully trusted sources are not affected. Exploitation also requires that a victim user loads the page containing the affected form component (UI:R), limiting mass automated exploitation. Authentication requirements depend on application design: if the attacker can influence label model data without being authenticated (e.g., via a public registration flow), no authentication is needed.

Severity is rated moderate by Apache, consistent with a typical stored or reflected XSS requiring user interaction (UI:R). No CVSS vector was published with this advisory, so exact metrics must be inferred from the description. The attack requires that attacker-controlled data reach a form component label model - this is an application-design prerequisite, not a universal exposure; not every Wicket deployment will pass untrusted input through setLabel(). However, because AutoLabelTextResolver is registered by default and the escape-model-strings bypass was silent and undocumented, developers had no indication their application was misconfigured. No EPSS score is available, KEV status is negative, and no POC has been identified - real-world exploitation probability appears low at present but could increase if a public demonstration is released. The breadth of affected versions (8.x through 10.x, plus all unsupported releases from 1.5.0) means the patch surface is wide across the ecosystem. CVSS score is officially listed as N/A; severity is based solely on the vendor's 'moderate' classification and technical description.

An attacker submits a registration form in a vulnerable Wicket application where the field label is dynamically set from a user-profile attribute (e.g., a display name stored in a database). When the admin or another user views a page containing that form component, the malicious label value is rendered as raw HTML - executing JavaScript that steals the victim's session cookie or performs actions on their behalf. No public exploit code has been identified at time of analysis, but the attack pattern is straightforward for any developer familiar with Wicket's rendering model.