Improper authorization in vaadin
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.
Summary
A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 23.1.0 - 23.6.13 Vaadin 24.0.0 - 24.9.21 Vaadin 24.10.0 - 24.10.9 Vaadin 25.0.0 - 25.1.11 Vaadin 25.2.0 - 25.2.6 Vaadin Framework 7 and 8 with the Spreadsheet add-on 2.0.0 - 3.1.0 Mitigation Upgrade to 23.6.14 Upgrade to 24.9.22 Upgrade to 24.10.10 Upgrade to 25.1.12 Upgrade to 25.2.7 or newer Upgrade the Spreadsheet add-on to 3.1.1 Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version. Artifacts Maven coordinates Vulnerable versions Fixed version com.vaadin:vaadin 23.1.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin 24.0.0 - 24.9.21 >=24.9.22 com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.9.21 >=24.9.22 com.vaadin:vaadin-spreadsheet-flow 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-spreadsheet-flow 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-spreadsheet-flow 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-spreadsheet 2.0.0 - 3.1.0 >=3.1.1
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Vaadin | vaadin | 23.1.0 to before 23.6.14; 24.0.0 to before 24.9.22; 24.10.0 to before 24.10.10; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.7 | 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 | Patch available | CNA |
| Vaadin | vaadin-spreadsheet-flow | 23.1.0 to before 23.6.14; 24.0.0 to before 24.9.22; 24.10.0 to before 24.10.10; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.7 | 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 | Patch available | CNA |
| Vaadin | vaadin-spreadsheet | 2.0.0 to before 3.1.1 | 3.1.1 | Patch available | CNA |
- vaadin VendorVaadin Affected 23.1.0 to before 23.6.14; 24.0.0 to before 24.9.22; 24.10.0 to before 24.10.10; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.7 Fixed in 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 Patch available CNA
- vaadin-spreadsheet-flow VendorVaadin Affected 23.1.0 to before 23.6.14; 24.0.0 to before 24.9.22; 24.10.0 to before 24.10.10; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.7 Fixed in 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 Patch available CNA
- vaadin-spreadsheet VendorVaadin Affected 2.0.0 to before 3.1.1 Fixed in 3.1.1 Patch available CNA
Remediation
- Fix · CNA vaadin (vaadin) Fixed in 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7
- Fix · CNA vaadin-spreadsheet-flow (vaadin) Fixed in 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7
- Fix · CNA vaadin-spreadsheet (vaadin) Fixed in 3.1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-93547
- 2026-10-03 Alias added: GHSA-74m8-whmf-rxrq
References
Other 8
- https://vaadin.com/security/cve-2026-93547
- https://github.com/vaadin/flow-components/pull/9905
- https://github.com/vaadin/flow-components/pull/9907
- https://github.com/vaadin/flow-components/pull/9908
- https://github.com/vaadin/flow-components/pull/9909
- https://github.com/vaadin/flow-components/pull/9910
- https://github.com/vaadin/flow-components/pull/9956
- https://github.com/vaadin/spreadsheet/pull/866
More Vaadin vulnerabilities
- TI-2026-81073 Vaadin push endpoint reflects any Origin and allows credentials CVSS 4.0LOW 2.3
- TI-2026-78950 Session lock leak in Vaadin Framework 8 allows denial of service CVSS 4.0HIGH 8.7
- TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
- TI-2021-11542 Project sources exposure in Vaadin Designer CVSS 3.1HIGH 8.6
- TI-2026-78949 Multiple flaws in Highcharts bundled with Vaadin Charts CVSS 4.0HIGH 8.4
- TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
Sources
- CVE-2026-93547 · CVE Program
- CVE-2026-93547 · NVD
- FIRST EPSS
- GHSA-74m8-whmf-rxrq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences