CVE-2026-33229

@@ -22,6 +22,7 @@
 import java.util.Set;
 
 import javax.servlet.ServletContext;
+import javax.servlet.ServletRequest;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
 
@@ -80,6 +81,24 @@ public ServletContext getServletContext()
         return null;
     }
 
+    /**
+     * {@inheritDoc}
+     * <p>
+     * Only allowed to author with programming right because it allows access to the underlying request that doesn't
+     * enforce any security checks.
+     *
+     * @see javax.servlet.ServletRequestWrapper#getRequest()
+     */
+    @Override
+    public ServletRequest getRequest()
+    {
+        if (this.authorization.hasAccess(Right.PROGRAM)) {
+            return super.getRequest();
+        }
+
+        return null;
+    }
+
     /**
      * {@inheritDoc}
      * <p>

@@ -147,6 +147,18 @@ void getHttpServletRequest()
         assertSame(this.scriptRequest, this.scriptRequest.getHttpServletRequest());
     }
 
+    @Test
+    void getRequest()
+    {
+        setProgramingRight(true);
+
+        assertSame(this.request, this.scriptRequest.getRequest());
+
+        setProgramingRight(false);
+
+        assertNull(this.scriptRequest.getRequest());
+    }
+
     @Test
     void sessionGetServletContext()
     {