Vaadin Spreadsheet Flow
Monthly
The Vaadin Spreadsheet component fails to enforce sheet protection when writing cell comments, so any authenticated user of an application that renders a spreadsheet can insert or overwrite comments on a protected sheet - including on cells that are explicitly locked - and can write a comment to a cell that does not yet exist, which creates the underlying row and cell. Only logged-in users of the host application are affected (CVSS v4.0 base 5.3; independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and the impact is confined to spreadsheet integrity: no confidentiality or availability impact, no user interaction, and low attack complexity. Exploitation requires the Spreadsheet component to actually be rendered, sheet protection to be enabled, and a valid session; no public exploit code or CISA KEV entry is identified at time of analysis. Fixed releases (Vaadin 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 and Spreadsheet add-on 3.1.1) are available per the vendor advisory.
The Vaadin Spreadsheet component fails to enforce sheet protection when writing cell comments, so any authenticated user of an application that renders a spreadsheet can insert or overwrite comments on a protected sheet - including on cells that are explicitly locked - and can write a comment to a cell that does not yet exist, which creates the underlying row and cell. Only logged-in users of the host application are affected (CVSS v4.0 base 5.3; independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and the impact is confined to spreadsheet integrity: no confidentiality or availability impact, no user interaction, and low attack complexity. Exploitation requires the Spreadsheet component to actually be rendered, sheet protection to be enabled, and a valid session; no public exploit code or CISA KEV entry is identified at time of analysis. Fixed releases (Vaadin 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 and Spreadsheet add-on 3.1.1) are available per the vendor advisory.