CVE-2026-57954: Elide 7.1.17 - Permission Bypass in Sort Expression Validation

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-29 · updated 2026-10-25
Weakness: CWE-862

Description

Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across all rows via both JSON:API and GraphQL read paths.

Affected products

yahoo elide: through 7.1.17

References

https://github.com/yahoo/elide/issues/3415
https://www.vulncheck.com/advisories/elide-permission-bypass-in-sort-expression-validation
https://github.com/yahoo/elide/issues/3415

Get alerted when CVE-2026-57954 or the next vulnerability affects your stack