{"id":"CVE-2026-93547","state":"PUBLISHED","title":"Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells","description":"A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 23.1.0 - 23.6.13\nVaadin 24.0.0 - 24.9.21\nVaadin 24.10.0 - 24.10.9\nVaadin 25.0.0 - 25.1.11\nVaadin 25.2.0 - 25.2.6\nVaadin Framework 7 and 8 with the Spreadsheet add-on 2.0.0 - 3.1.0\n\nMitigation\nUpgrade to 23.6.14\nUpgrade to 24.9.22\nUpgrade to 24.10.10\nUpgrade to 25.1.12\nUpgrade to 25.2.7 or newer\nUpgrade the Spreadsheet add-on to 3.1.1\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates Vulnerable versions Fixed version\ncom.vaadin:vaadin 23.1.0 - 23.6.13 >=23.6.14\ncom.vaadin:vaadin 24.0.0 - 24.9.21 >=24.9.22\ncom.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7\ncom.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.13 >=23.6.14\ncom.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.9.21 >=24.9.22\ncom.vaadin:vaadin-spreadsheet-flow 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin-spreadsheet-flow 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin-spreadsheet-flow 25.2.0 - 25.2.6 >=25.2.7\ncom.vaadin:vaadin-spreadsheet 2.0.0 - 3.1.0 >=3.1.1","publishedAt":"2026-09-30T13:13:13.074Z","updatedAt":"2026-10-03T13:52:42.352Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"Vaadin"},"assigner":"Vaadin","products":["vaadin vaadin","vaadin vaadin-spreadsheet-flow","vaadin vaadin-spreadsheet"],"affected":[{"vendor":"vaadin","product":"vaadin","packageName":"com.vaadin:vaadin","defaultStatus":"unaffected","versions":[{"version":"23.1.0","status":"affected","lessThan":"23.6.14","versionType":"maven"},{"version":"24.0.0","status":"affected","lessThan":"24.9.22","versionType":"maven"},{"version":"24.10.0","status":"affected","lessThan":"24.10.10","versionType":"maven"},{"version":"25.0.0","status":"affected","lessThan":"25.1.12","versionType":"maven"},{"version":"25.2.0","status":"affected","lessThan":"25.2.7","versionType":"maven"}],"collectionURL":"https://repo.maven.apache.org/maven2","repo":"https://github.com/vaadin/platform"},{"vendor":"vaadin","product":"vaadin-spreadsheet-flow","packageName":"com.vaadin:vaadin-spreadsheet-flow","defaultStatus":"unaffected","versions":[{"version":"23.1.0","status":"affected","lessThan":"23.6.14","versionType":"maven"},{"version":"24.0.0","status":"affected","lessThan":"24.9.22","versionType":"maven"},{"version":"24.10.0","status":"affected","lessThan":"24.10.10","versionType":"maven"},{"version":"25.0.0","status":"affected","lessThan":"25.1.12","versionType":"maven"},{"version":"25.2.0","status":"affected","lessThan":"25.2.7","versionType":"maven"}],"collectionURL":"https://repo.maven.apache.org/maven2","repo":"https://github.com/vaadin/flow-components"},{"vendor":"vaadin","product":"vaadin-spreadsheet","packageName":"com.vaadin:vaadin-spreadsheet","defaultStatus":"unaffected","versions":[{"version":"2.0.0","status":"affected","lessThan":"3.1.1","versionType":"maven"}],"collectionURL":"https://maven.vaadin.com/vaadin-addons","repo":"https://github.com/vaadin/spreadsheet"}],"references":["https://vaadin.com/security/cve-2026-93547","https://github.com/vaadin/flow-components/pull/9905","https://github.com/vaadin/flow-components/pull/9907","https://github.com/vaadin/flow-components/pull/9908","https://github.com/vaadin/flow-components/pull/9909","https://github.com/vaadin/flow-components/pull/9910","https://github.com/vaadin/flow-components/pull/9956","https://github.com/vaadin/spreadsheet/pull/866"],"weaknesses":["CWE-285"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/93xxx/CVE-2026-93547.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-93547","state":"PUBLISHED","datePublished":"2026-09-30T13:13:13.074Z","dateUpdated":"2026-10-03T13:52:42.352Z","assignerShortName":"Vaadin","assignerOrgId":"9e0f3122-90e9-42d5-93de-8c6b98deef7e","dateReserved":"2026-09-18T09:22:10.216Z"},"containers":{"cna":{"title":"Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells","descriptions":[{"lang":"en","value":"A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 23.1.0 - 23.6.13\nVaadin 24.0.0 - 24.9.21\nVaadin 24.10.0 - 24.10.9\nVaadin 25.0.0 - 25.1.11\nVaadin 25.2.0 - 25.2.6\nVaadin Framework 7 and 8 with the Spreadsheet add-on 2.0.0 - 3.1.0\n\nMitigation\nUpgrade to 23.6.14\nUpgrade to 24.9.22\nUpgrade to 24.10.10\nUpgrade to 25.1.12\nUpgrade to 25.2.7 or newer\nUpgrade the Spreadsheet add-on to 3.1.1\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates Vulnerable versions Fixed version\ncom.vaadin:vaadin 23.1.0 - 23.6.13 >=23.6.14\ncom.vaadin:vaadin 24.0.0 - 24.9.21 >=24.9.22\ncom.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7\ncom.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.13 >=23.6.14\ncom.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.9.21 >=24.9.22\ncom.vaadin:vaadin-spreadsheet-flow 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin-spreadsheet-flow 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin-spreadsheet-flow 25.2.0 - 25.2.6 >=25.2.7\ncom.vaadin:vaadin-spreadsheet 2.0.0 - 3.1.0 >=3.1.1"}],"affected":[{"vendor":"vaadin","product":"vaadin","packageName":"com.vaadin:vaadin","defaultStatus":"unaffected","versions":[{"version":"23.1.0","status":"affected","lessThan":"23.6.14","versionType":"maven"},{"version":"24.0.0","status":"affected","lessThan":"24.9.22","versionType":"maven"},{"version":"24.10.0","status":"affected","lessThan":"24.10.10","versionType":"maven"},{"version":"25.0.0","status":"affected","lessThan":"25.1.12","versionType":"maven"},{"version":"25.2.0","status":"affected","lessThan":"25.2.7","versionType":"maven"}],"collectionURL":"https://repo.maven.apache.org/maven2","repo":"https://github.com/vaadin/platform"},{"vendor":"vaadin","product":"vaadin-spreadsheet-flow","packageName":"com.vaadin:vaadin-spreadsheet-flow","defaultStatus":"unaffected","versions":[{"version":"23.1.0","status":"affected","lessThan":"23.6.14","versionType":"maven"},{"version":"24.0.0","status":"affected","lessThan":"24.9.22","versionType":"maven"},{"version":"24.10.0","status":"affected","lessThan":"24.10.10","versionType":"maven"},{"version":"25.0.0","status":"affected","lessThan":"25.1.12","versionType":"maven"},{"version":"25.2.0","status":"affected","lessThan":"25.2.7","versionType":"maven"}],"collectionURL":"https://repo.maven.apache.org/maven2","repo":"https://github.com/vaadin/flow-components"},{"vendor":"vaadin","product":"vaadin-spreadsheet","packageName":"com.vaadin:vaadin-spreadsheet","defaultStatus":"unaffected","versions":[{"version":"2.0.0","status":"affected","lessThan":"3.1.1","versionType":"maven"}],"collectionURL":"https://maven.vaadin.com/vaadin-addons","repo":"https://github.com/vaadin/spreadsheet"}],"references":[{"url":"https://vaadin.com/security/cve-2026-93547"},{"url":"https://github.com/vaadin/flow-components/pull/9905"},{"url":"https://github.com/vaadin/flow-components/pull/9907"},{"url":"https://github.com/vaadin/flow-components/pull/9908"},{"url":"https://github.com/vaadin/flow-components/pull/9909"},{"url":"https://github.com/vaadin/flow-components/pull/9910"},{"url":"https://github.com/vaadin/flow-components/pull/9956"},{"url":"https://github.com/vaadin/spreadsheet/pull/866"}],"metrics":[{"cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NEGLIGIBLE","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"LOW","providerUrgency":"CLEAR"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-285","description":"CWE-285 Improper Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Vaadin","orgId":"9e0f3122-90e9-42d5-93de-8c6b98deef7e","dateUpdated":"2026-10-03T13:52:42.352Z"},"impacts":[{"capecId":"CAPEC-122","descriptions":[{"lang":"en","value":"CAPEC-122 Privilege Abuse"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<b><span style=\"background-color: transparent;\">Users of affected versions should apply the following mitigation or upgrade.</span></b><br>"}],"value":"Users of affected versions should apply the following mitigation or upgrade."}],"source":{"discovery":"EXTERNAL"},"credits":[{"lang":"en","type":"finder","value":"Arpit Jain (GitHub: arpitjain099)"}],"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-30T14:25:51.477902Z","id":"CVE-2026-93547","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-30T14:26:02.005Z"}}]}}}