CVE-2026-93547

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.<br /> <br /> <br /> Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:<br /> <br /> Product version<br /> Vaadin 23.1.0 - 23.6.13<br /> Vaadin 24.0.0 - 24.9.21<br /> Vaadin 24.10.0 - 24.10.9<br /> Vaadin 25.0.0 - 25.1.11<br /> Vaadin 25.2.0 - 25.2.6<br /> Vaadin Framework 7 and 8 with the Spreadsheet add-on 2.0.0 - 3.1.0<br /> <br /> Mitigation<br /> Upgrade to 23.6.14<br /> Upgrade to 24.9.22<br /> Upgrade to 24.10.10<br /> Upgrade to 25.1.12<br /> Upgrade to 25.2.7 or newer<br /> Upgrade the Spreadsheet add-on to 3.1.1<br /> <br /> Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.<br /> <br /> Artifacts<br /> Maven coordinates Vulnerable versions Fixed version<br /> com.vaadin:vaadin 23.1.0 - 23.6.13 &gt;=23.6.14<br /> com.vaadin:vaadin 24.0.0 - 24.9.21 &gt;=24.9.22<br /> com.vaadin:vaadin 24.10.0 - 24.10.9 &gt;=24.10.10<br /> com.vaadin:vaadin 25.0.0 - 25.1.11 &gt;=25.1.12<br /> com.vaadin:vaadin 25.2.0 - 25.2.6 &gt;=25.2.7<br /> com.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.13 &gt;=23.6.14<br /> com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.9.21 &gt;=24.9.22<br /> com.vaadin:vaadin-spreadsheet-flow 24.10.0 - 24.10.9 &gt;=24.10.10<br /> com.vaadin:vaadin-spreadsheet-flow 25.0.0 - 25.1.11 &gt;=25.1.12<br /> com.vaadin:vaadin-spreadsheet-flow 25.2.0 - 25.2.6 &gt;=25.2.7<br /> com.vaadin:vaadin-spreadsheet 2.0.0 - 3.1.0 &gt;=3.1.1