CVE-2026-57954

MEDIUM

Elide 7.1.17 - Permission Bypass in Sort Expression Validation

Title source: cna

Description

Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across all rows via both JSON:API and GraphQL read paths.

References (2)

Core 2

Core References

Issue Tracking issue-tracking

Researcher Disclosure

https://github.com/yahoo/elide/issues/3415

Third Party Advisory third-party-advisory

https://www.vulncheck.com/advisories/elide-permission-bypass-in-sort-expression-validation

Scores

CVSS v3 4.3

EPSS 0.0017

EPSS Percentile 6.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (1)

yahoo/elide < 7.1.17

Published Jun 29, 2026

Tracked Since Jun 29, 2026