« Volver al listado

CVE-2026-93547

Estado: Pendiente de análisisMedia (5.3)—

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version Vaadin 23.1.0 - 23.6.13 Vaadin 24.0.0 - 24.9.21 Vaadin 24.10.0 - 24.10.9 Vaadin 25.0.0 - 25.1.11 Vaadin 25.2.0 - 25.2.6 Vaadin Framework 7 and 8 with the Spreadsheet add-on 2.0.0 - 3.1.0

Leer descripción completaMostrar menos

Mitigation Upgrade to 23.6.14 Upgrade to 24.9.22 Upgrade to 24.10.10 Upgrade to 25.1.12 Upgrade to 25.2.7 or newer Upgrade the Spreadsheet add-on to 3.1.1

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.

Artifacts Maven coordinates Vulnerable versions Fixed version com.vaadin:vaadin 23.1.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin 24.0.0 - 24.9.21 >=24.9.22 com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.9.21 >=24.9.22 com.vaadin:vaadin-spreadsheet-flow 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-spreadsheet-flow 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-spreadsheet-flow 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-spreadsheet 2.0.0 - 3.1.0 >=3.1.1

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-285 (falta de autorización) permite a usuario autenticado modificar celdas protegidas y crear filas/celdas inexistentes; AV:N/PR:L sin UI indica explotación remota de servicio con autenticación previa (T1210). Impacto principal: manipulación de datos (comentarios, celdas, filas creadas). Secunda

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementPassword PoliciesRemote Data Storage

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Vaadin — VaadinAIVaadin — Vaadin SpreadsheetAIVaadin — Vaadin Spreadsheet FlowAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93547",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-93547",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-30T14:25:51.477902Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@vaadin.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@vaadin.com",
      "affectedData": [
        {
          "repo": "https://github.com/vaadin/platform",
          "vendor": "vaadin",
          "product": "vaadin",
          "versions": [
            {
              "status": "affected",
              "version": "23.1.0",
              "lessThan": "23.6.14",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "24.0.0",
              "lessThan": "24.9.22",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "24.10.0",
              "lessThan": "24.10.10",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "25.0.0",
              "lessThan": "25.1.12",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "25.2.0",
              "lessThan": "25.2.7",
              "versionType": "maven"
            }
          ],
          "packageName": "com.vaadin:vaadin",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://github.com/vaadin/flow-components",
          "vendor": "vaadin",
          "product": "vaadin-spreadsheet-flow",
          "versions": [
            {
              "status": "affected",
              "version": "23.1.0",
              "lessThan": "23.6.14",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "24.0.0",
              "lessThan": "24.9.22",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "24.10.0",
              "lessThan": "24.10.10",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "25.0.0",
              "lessThan": "25.1.12",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "25.2.0",
              "lessThan": "25.2.7",
              "versionType": "maven"
            }
          ],
          "packageName": "com.vaadin:vaadin-spreadsheet-flow",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://github.com/vaadin/spreadsheet",
          "vendor": "vaadin",
          "product": "vaadin-spreadsheet",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "3.1.1",
              "versionType": "maven"
            }
          ],
          "packageName": "com.vaadin:vaadin-spreadsheet",
          "collectionURL": "https://maven.vaadin.com/vaadin-addons",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-30T14:17:34.997",
  "references": [
    {
      "url": "https://github.com/vaadin/flow-components/pull/9905",
      "source": "security@vaadin.com"
    },
    {
      "url": "https://github.com/vaadin/flow-components/pull/9907",
      "source": "security@vaadin.com"
    },
    {
      "url": "https://github.com/vaadin/flow-components/pull/9908",
      "source": "security@vaadin.com"
    },
    {
      "url": "https://github.com/vaadin/flow-components/pull/9909",
      "source": "security@vaadin.com"
    },
    {
      "url": "https://github.com/vaadin/flow-components/pull/9910",
      "source": "security@vaadin.com"
    },
    {
      "url": "https://github.com/vaadin/flow-components/pull/9956",
      "source": "security@vaadin.com"
    },
    {
      "url": "https://github.com/vaadin/spreadsheet/pull/866",
      "source": "security@vaadin.com"
    },
    {
      "url": "https://vaadin.com/security/cve-2026-93547",
      "source": "security@vaadin.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@vaadin.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 23.1.0 - 23.6.13\nVaadin 24.0.0 - 24.9.21\nVaadin 24.10.0 - 24.10.9\nVaadin 25.0.0 - 25.1.11\nVaadin 25.2.0 - 25.2.6\nVaadin Framework 7 and 8 with the Spreadsheet add-on 2.0.0 - 3.1.0\n\nMitigation\nUpgrade to 23.6.14\nUpgrade to 24.9.22\nUpgrade to 24.10.10\nUpgrade to 25.1.12\nUpgrade to 25.2.7 or newer\nUpgrade the Spreadsheet add-on to 3.1.1\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates Vulnerable versions Fixed version\ncom.vaadin:vaadin 23.1.0 - 23.6.13 >=23.6.14\ncom.vaadin:vaadin 24.0.0 - 24.9.21 >=24.9.22\ncom.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7\ncom.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.13 >=23.6.14\ncom.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.9.21 >=24.9.22\ncom.vaadin:vaadin-spreadsheet-flow 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin-spreadsheet-flow 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin-spreadsheet-flow 25.2.0 - 25.2.6 >=25.2.7\ncom.vaadin:vaadin-spreadsheet 2.0.0 - 3.1.0 >=3.1.1"
    }
  ],
  "lastModified": "2026-09-30T16:38:20.847",
  "sourceIdentifier": "security@vaadin.com"
}