AIKIDO-2026-10796
@univerjs/sheets is vulnerable to Incorrect Authorization
71
High Risk
This Affects:
@univerjs/sheetsTL;DR
Collaborative Univer Sheets integrates permission rules so only allowed roles can run mutating commands against a workbook. Certain API-driven operations skipped the intended guard path because permission checks did not consistently key off the concrete command being executed. That gap let callers perform edits that permission configuration was supposed to deny. Routing checks through the proper command-aware permission path closes those bypasses.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@univerjs/sheets is vulnerable to Incorrect Authorization in versions 0.5.4 - 0.20.1.
How to fix this
Upgrade the @univerjs/sheets library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant