A missing authorization check in the Vaadin Spreadsheet component lets an authenticated user of an application that renders a spreadsheet add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. The flaw also permits creating new rows and cells by writing a comment to a cell that does not yet exist, thereby potentially altering or inserting information where it should not be accessible. The weakness is an improper authorization issue (CWE-285) that can be exploited to tamper with spreadsheet data in a way that may mislead users or propagate errors.

The vulnerability affects Vaadin Framework and Spreadsheet components from Vaadin 23.1.0 through 25.2.6, including the Spreadsheet add‑on 2.0.0‑3.1.0. Fixed releases begin at Vaadin 23.6.14 for the 23.x line, 24.9.22 for the 24.x line, 25.1.12 (or 25.2.7) for the 25.x line, and Spreadsheet add‑on 3.1.1. Applications built with unsupported Vaadin 10‑13 or 15‑22 are also impacted.

The CVSS score of 5.3 indicates a moderate risk. No EPSS score is available, and the vulnerability is not listed in CISA KEV, suggesting limited direct exploitation evidence. An attacker needs to be an authenticated user of the application that renders the spreadsheet, so the attack surface is limited to applications that allow spreadsheet interaction. However, within that scope the can be readily exercised, so timely patching is recommended.