CVE-2026-57954CWE-862

Elide 7.1.17 - Permission Bypass in Sort Expression Validation

Medium · published June 29, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
19.6
In the wild
Unconfirmed
What it is

Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across all rows via both JSON:API and GraphQL read paths.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00281 · 19.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-06-29T17:21Z
EPSS history
Timeline
  • 29 JUN 17:21Z
    Elide 7.1.17 - Permission Bypass in Sort Expression Validation
    cvelistv5