Apache Wicket CVE-2026-87718

Exploitation requires a non-default deployment where the application wraps a page's render request handler in more than one IRequestHandlerDelegate (a delegate chain deeper than one level - e.g. an application-provided delegating request mapper combined with CryptoMapper), AND CSP must be enabled in the application; under these conditions the affected page is served with no CSP header and the nonce-based inline-script/style protection is lost. The affected versions are exactly 10.10.0, 10.11.0 and 9.24.0; versions before 10.10.0 and 9.24.0 handled nested delegates correctly. Limiting factors: stock Wicket applications that do not wrap request handlers themselves are not affected; the flaw only removes a protective control, so actual content injection also requires a separate injection vector on the page plus a victim rendering it (passive user interaction).

All signals point to a genuinely low priority. The input CVSS 4.0 score is 2.3 (Low) with VC:N/VI:N/VA:N - there is no direct impact on the vulnerable system; only subsequent-system confidentiality and integrity are rated Low (SC:L/SI:L), reflecting that this is a protection-mechanism failure (CWE-693) rather than a directly exploitable flaw. The vuln.today decision label is 'monitor', the lowest urgency tier, and the vulnerability is not in CISA KEV, has no public exploit identified at time of analysis, and no EPSS score was provided. Crucially, the flaw only manifests when the application itself wraps request handlers in more than one IRequestHandlerDelegate - stock Wicket applications are explicitly stated to be unaffected - so the real-world exposed population is a subset of an already modest user base. The net effect is loss of a defense-in-depth control (CSP nonce protection), which has no impact unless a separate content-injection vulnerability already exists on an affected page. The AT:P (attack requirement present) and UI:P (passive user interaction) metrics are consistent with the description's requirement for a specific non-default handler-wrapping configuration and a victim rendering the affected page. This is a high-correctness, low-real-risk hardening fix, not an emergency.

An application built on Apache Wicket 10.10.0/10.11.0/9.24.0 that combines a custom delegating request mapper with CryptoMapper serves certain pages with no Content-Security-Policy header, silently dropping the nonce-based inline-script/style protection. If such a page also contains a content-injection sink, an attacker can inject inline script or style that the CSP was meant to block, and it executes when a victim loads the page. No public exploit is identified at time of analysis, and the weakness is only reachable in non-default configurations where the application wraps request handlers in a nested delegate chain.