Medium severity4.3NVD Advisory· Published Jun 29, 2026· Updated Jun 30, 2026

CVE-2026-57954

Description

Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across all rows via both JSON:API and GraphQL read paths.

Affected products

Yahoo/Elidellm-fuzzy
Range: <=7.1.17

Patches

Vulnerability mechanics

References

github.com/yahoo/elide/issues/3415nvd
www.vulncheck.com/advisories/elide-permission-bypass-in-sort-expression-validationnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000