CVE-2026-93547 in Vaadin
Summary
by MITRE • 09/30/2026
A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version Vaadin 23.1.0 - 23.6.13 Vaadin 24.0.0 - 24.9.21 Vaadin 24.10.0 - 24.10.9 Vaadin 25.0.0 - 25.1.11 Vaadin 25.2.0 - 25.2.6 Vaadin Framework 7 and 8 with the Spreadsheet add-on 2.0.0 - 3.1.0
Mitigation Upgrade to 23.6.14 Upgrade to 24.9.22 Upgrade to 24.10.10 Upgrade to 25.1.12 Upgrade to 25.2.7 or newer Upgrade the Spreadsheet add-on to 3.1.1
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.
Artifacts Maven coordinates Vulnerable versions Fixed version com.vaadin:vaadin 23.1.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin 24.0.0 - 24.9.21 >=24.9.22 com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.9.21 >=24.9.22 com.vaadin:vaadin-spreadsheet-flow 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-spreadsheet-flow 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-spreadsheet-flow 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-spreadsheet 2.0.0 - 3.1.0 >=3.1.1
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in the Vaadin Spreadsheet component represents a critical failure in server-side access control mechanisms, specifically categorized under CWE-862 Missing Authorization. This flaw allows authenticated users to bypass protection settings that are intended to restrict modifications to specific cells or entire sheets within a spreadsheet document. In enterprise environments where spreadsheets are used for sensitive data management, such as financial reporting or confidential project tracking, the integrity of locked and protected areas is paramount. The vulnerability arises because the backend logic responsible for handling cell comment operations does not adequately verify whether the target cell or sheet has protection enabled before processing the request to add or replace a comment. This oversight effectively neutralizes the security controls implemented by application developers who rely on spreadsheet locking features to prevent unauthorized edits, thereby undermining the confidentiality and integrity of protected data segments.
From an operational perspective, this vulnerability enables attackers with valid credentials for the affected application to inject malicious content into areas that should be immutable. By adding or replacing cell comments, an attacker can disseminate misleading information, social engineering payloads, or persistent threats within a document viewed by other users. Furthermore, the ability to write a comment to a non-existent cell results in the automatic creation of new rows and cells on the sheet. This side effect expands the attack surface beyond just existing data structures, allowing for potential denial-of-service conditions through resource exhaustion if an attacker repeatedly creates empty rows or manipulates the document structure unpredictably. Such behavior can corrupt the layout and functionality of critical business documents, leading to significant operational disruptions and loss of trust in the application's reliability.
The technical execution of this exploit leverages the standard API endpoints exposed by the Vaadin framework for handling spreadsheet interactions. Since authentication is already established, the attacker simply sends a crafted request containing comment data targeting protected cells or new cell coordinates. The server processes this request without checking the protection status defined in the sheet's metadata, treating it as a valid modification operation. This aligns with ATT&CK technique T1078 Valid Accounts, where an adversary uses legitimate credentials to perform actions that violate policy constraints due to insufficient authorization checks on specific resources. The lack of granular permission validation for protected regions highlights a gap in the framework's default security model regarding fine-grained access control for document elements.
To mitigate this risk, organizations must immediately upgrade their Vaadin dependencies to versions where this issue has been resolved. For users running Vaadin 23.x, an upgrade to version 23.6.14 or later is required. Those on the 24.x branch should update to at least 24.9.22 for older releases within that major version line, or 24.10.10 and newer for more recent iterations. For Vaadin 25 users, upgrading to 25.1.12 or later is necessary, with versions starting from 25.2.7 also being secure. If the application utilizes the standalone Spreadsheet add-on rather than the Flow variant, it must be updated to version 3.1.1 or higher. It is crucial for development teams to verify their Maven coordinates and ensure that all transitive dependencies are aligned with these fixed versions. Additionally, since older major versions such as Vaadin 10 through 22 are no longer supported, migrating to the latest stable release of the framework is strongly recommended to benefit from comprehensive security patches and modern architectural improvements beyond just this specific fix.