{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "23.1.0"
              },
              {
                "fixed": "23.6.14"
              },
              {
                "introduced": "24.0.0"
              },
              {
                "fixed": "24.9.22"
              },
              {
                "introduced": "24.10.0"
              },
              {
                "fixed": "24.10.10"
              },
              {
                "introduced": "25.0.0"
              },
              {
                "fixed": "25.1.12"
              },
              {
                "introduced": "25.2.0"
              },
              {
                "fixed": "25.2.7"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "fc0309382457a3595d4b766b40a57ccebca3b2c8"
            },
            {
              "fixed": "41da1428d6c458919f7effaeca8b8317d2d1bc74"
            },
            {
              "introduced": "f86528dc71f22a535a8172fafca6fe128d3b89da"
            },
            {
              "fixed": "7e3951a1ef87880b6994dc69966c5969dd730c8a"
            },
            {
              "introduced": "ffc51a5b98b21f3a15191039050e9d8a8bf464cf"
            },
            {
              "fixed": "b2210855d02d7e09d2e4c2b27bfe4f3f0ce99ae3"
            },
            {
              "introduced": "2099b3c966835d8e2677c1d638bc3624ebbb8c87"
            },
            {
              "fixed": "47cf689e61827dc711be69dba6a9d8d04b74a375"
            },
            {
              "introduced": "2aa7290bdb7e8bff78ec91334627c2ed852539dc"
            },
            {
              "fixed": "8c5c6348444a0b10a0d6e00f9a7490a8a3b63d18"
            }
          ],
          "repo": "https://github.com/vaadin/flow-components",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Vaadin",
    "cwe_ids": [
      "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93547.json",
    "unresolved_ranges": [
      {
        "extracted_events": [
          {
            "introduced": "2.0.0"
          },
          {
            "fixed": "3.1.1"
          }
        ],
        "source": "AFFECTED_FIELD"
      }
    ]
  },
  "details": "A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 23.1.0 - 23.6.13\nVaadin 24.0.0 - 24.9.21\nVaadin 24.10.0 - 24.10.9\nVaadin 25.0.0 - 25.1.11\nVaadin 25.2.0 - 25.2.6\nVaadin Framework 7 and 8 with the Spreadsheet add-on 2.0.0 - 3.1.0\n\nMitigation\nUpgrade to 23.6.14\nUpgrade to 24.9.22\nUpgrade to 24.10.10\nUpgrade to 25.1.12\nUpgrade to 25.2.7 or newer\nUpgrade the Spreadsheet add-on to 3.1.1\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates Vulnerable versions Fixed version\ncom.vaadin:vaadin 23.1.0 - 23.6.13 \u003e=23.6.14\ncom.vaadin:vaadin 24.0.0 - 24.9.21 \u003e=24.9.22\ncom.vaadin:vaadin 24.10.0 - 24.10.9 \u003e=24.10.10\ncom.vaadin:vaadin 25.0.0 - 25.1.11 \u003e=25.1.12\ncom.vaadin:vaadin 25.2.0 - 25.2.6 \u003e=25.2.7\ncom.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.13 \u003e=23.6.14\ncom.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.9.21 \u003e=24.9.22\ncom.vaadin:vaadin-spreadsheet-flow 24.10.0 - 24.10.9 \u003e=24.10.10\ncom.vaadin:vaadin-spreadsheet-flow 25.0.0 - 25.1.11 \u003e=25.1.12\ncom.vaadin:vaadin-spreadsheet-flow 25.2.0 - 25.2.6 \u003e=25.2.7\ncom.vaadin:vaadin-spreadsheet 2.0.0 - 3.1.0 \u003e=3.1.1",
  "id": "CVE-2026-93547",
  "modified": "2026-10-02T03:30:29.093173028Z",
  "published": "2026-09-30T13:13:13.074Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://maven.vaadin.com/vaadin-addons"
    },
    {
      "type": "WEB",
      "url": "https://repo.maven.apache.org/maven2"
    },
    {
      "type": "WEB",
      "url": "https://vaadin.com/security/cve-2026-93547"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93547.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93547"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/9905"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/9907"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/9908"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/9909"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/9910"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/9956"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/spreadsheet/pull/866"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vaadin/flow-components"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vaadin/platform"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vaadin/spreadsheet"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells"
}