Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in SpreadsheetHandlerImpl.updateCellComment, which writes the supplied text to the target cell without checking whether the active sheet is protected or the cell locked, unlike the edit, cut, and paste handlers i...

com.vaadin:vaadin (>=25.2.0-beta1, <=25.2.6), com.vaadin:vaadin-ee (>=25.2.2, <=25.2.6) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.2.0-beta1, <=25.2.6)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.2.0-beta1, =25.2.0-beta1, =25.2.2, =25.2.6 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=24.7.0, <=24.9.21) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.7.0, <=24.9.21)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.7.0, =24.7.0, =24.9.21 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=24.10.0-beta1, <=24.10.9) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.10.0-beta1, <=24.10.9)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.10.0-beta1, =24.10.0-beta1, =24.10.9 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=23.1.0, <=23.1.17), com.vaadin:vaadin-jandex (>=23.1.0, <=23.1.17) +2 more potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=23.1.0, <=23.1.17)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =23.1.0, =23.1.0, =23.1.0, =23.1.0, =2.5.2, =2.5.3 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=25.0.0-beta1, <=25.1.11) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.0.0-beta1, <=25.1.11)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.0.0-beta1, =25.0.0-beta1, =25.1.11 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=24.7.0, <=24.9.21) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.7.0, <=24.9.21)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.7.0, =24.7.0, =24.9.21 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

com.vaadin:vaadin (>=24.10.0, <=24.10.9) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.10.0, <=24.10.9)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.10.0, =24.10.0, =24.10.9 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

com.vaadin:vaadin (>=23.1.0, <=23.1.17), com.vaadin:vaadin-jandex (>=23.1.0, <=23.1.17) +2 more potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=23.1.0, <=23.1.17)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =23.1.0, =23.1.0, =23.1.0, =23.1.0, =2.5.2, =2.5.3 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

com.vaadin:vaadin (>=25.0.0, <=25.1.11) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.0.0, <=25.1.11)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.0.0, =25.0.0, =25.1.11 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

com.vaadin:vaadin (>=25.2.1, <=25.2.6), com.vaadin:vaadin-ee (>=25.2.2, <=25.2.6) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.2.1, <=25.2.6)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.2.1, =25.2.1, =25.2.2, =25.2.6 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

Missing sheet protection check when updating cell comments

The handler that updates a cell comment in the Vaadin Spreadsheet component did not re-check the sheet protection state, so a user of an application that renders a spreadsheet could add or replace comments on a protected sheet and on locked cells, and create empty cells in the process. See CWE-28...

com.vaadin:vaadin (>=24.7.0, <=24.8.13) potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=24.7.0, <=24.8.13)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.7.0, =24.7.0, =24.8.13 Source cves: CVE-2025-15022 Source advisory: GHSA-7WWV-79XW-RVVG...

com.vaadin:vaadin (>=24.9.0, <=24.9.6) potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=24.9.0, <=24.9.6)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.9.0, =24.9.0, =24.9.6 Source cves: CVE-2025-15022 Source advisory: GHSA-7WWV-79XW-RVVG...

com.vaadin:vaadin (>=24.7.0, <=24.8.13) potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=24.7.0, <=24.8.13)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.7.0, =24.7.0, =24.8.13 Source cves: CVE-2025-15022 Source advisory: OSV:GHSA-7WWV-79XW-RVVG...

com.vaadin:vaadin (>=23.1.0, <=23.1.17), com.vaadin:vaadin-jandex (>=23.1.0, <=23.1.17) +2 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=23.1.0, <=23.1.17)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =23.1.0, =23.1.0, =23.1.0, =23.1.0, =2.5.2, =2.5.3 Source cves: CVE-2025-15022 Source advisory: GHSA-7WWV-79XW-RVVG...

com.vaadin:vaadin (>=23.1.0, <=23.1.17), com.vaadin:vaadin-jandex (>=23.1.0, <=23.1.17) +2 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=23.1.0, <=23.1.17)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =23.1.0, =23.1.0, =23.1.0, =23.1.0, =2.5.2, =2.5.3 Source cves: CVE-2025-15022 Source advisory: OSV:GHSA-7WWV-79XW-RVVG...

com.vaadin:vaadin (>=24.9.0, <=24.9.6) potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=24.9.0, <=24.9.6)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.9.0, =24.9.0, =24.9.6 Source cves: CVE-2025-15022 Source advisory: OSV:GHSA-7WWV-79XW-RVVG...

com.vaadin:vaadin (>=24.9.0, <=24.9.5) potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=24.9.0, <=24.9.5)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.9.0, =24.9.0, =24.9.5 Source cves: CVE-2025-15022 Source advisory: SNYK:JAVA-COMVAADIN-14860869...