com.vaadin:vaadin (>=23.1.0, <=23.1.17), com.vaadin:vaadin-jandex (>=23.1.0, <=23.1.17) +2 more potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=23.1.0, <=23.1.17)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =23.1.0, =23.1.0, =23.1.0, =23.1.0, =2.5.2, =2.5.3 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=24.7.0, <=24.9.21) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.7.0, <=24.9.21)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.7.0, =24.7.0, =24.9.21 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=24.10.0-beta1, <=24.10.9) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.10.0-beta1, <=24.10.9)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.10.0-beta1, =24.10.0-beta1, =24.10.9 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=25.0.0-beta1, <=25.1.11) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.0.0-beta1, <=25.1.11)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.0.0-beta1, =25.0.0-beta1, =25.1.11 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=25.2.0-beta1, <=25.2.6), com.vaadin:vaadin-ee (>=25.2.2, <=25.2.6) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.2.0-beta1, <=25.2.6)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.2.0-beta1, =25.2.0-beta1, =25.2.2, =25.2.6 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in SpreadsheetHandlerImpl.updateCellComment, which writes the supplied text to the target cell without checking whether the active sheet is protected or the cell locked, unlike the edit, cut, and paste handlers i...

CVE-2026-93547

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-93547

The Vaadin Spreadsheet component (including the Spreadsheet add-on for Vaadin Framework 7 and 8) contains a missing authorization check that allows authenticated users to add or replace cell comments on sheets with enabled protection, including locked cells. The underlying cause is that the handl...

com.vaadin:vaadin (>=23.1.0, <=23.1.17), com.vaadin:vaadin-jandex (>=23.1.0, <=23.1.17) +2 more potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=23.1.0, <=23.1.17)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =23.1.0, =23.1.0, =23.1.0, =23.1.0, =2.5.2, =2.5.3 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

com.vaadin:vaadin (>=24.7.0, <=24.9.21) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.7.0, <=24.9.21)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.7.0, =24.7.0, =24.9.21 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

com.vaadin:vaadin (>=24.10.0, <=24.10.9) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.10.0, <=24.10.9)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.10.0, =24.10.0, =24.10.9 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

com.vaadin:vaadin (>=25.0.0, <=25.1.11) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.0.0, <=25.1.11)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.0.0, =25.0.0, =25.1.11 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

com.vaadin:vaadin (>=25.2.1, <=25.2.6), com.vaadin:vaadin-ee (>=25.2.2, <=25.2.6) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.2.1, <=25.2.6)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.2.1, =25.2.1, =25.2.2, =25.2.6 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

CVE-2026-93547

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

EUVD-2026-89952

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

PT-2026-103275

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-93547: Improper Authorization

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...