CVE-2026-57954: Elide Information Disclosure Vulnerability

CVE-2026-57954 Overview

CVE-2026-57954 is a missing authorization vulnerability [CWE-862] affecting the Elide JSON:API and GraphQL framework through version 7.1.17. The flaw resides in SortingImpl.getValidSortingRules, which fails to enforce the @ReadPermission annotation on client-supplied sort expressions. Attackers with low-privileged API access can sort collections by fields they are not authorized to read. By observing the resulting row ordering, they can infer the relative values of hidden fields across records. The issue affects both JSON:API and GraphQL read paths exposed by Elide-based services.

Critical Impact
Authenticated attackers can leak the relative ordering of protected field values across all rows in a collection, exposing sensitive data such as password hashes, salaries, or timestamps through inference attacks.

Affected Products

Yahoo Elide framework versions through 7.1.17
Applications exposing JSON:API endpoints built on Elide
Applications exposing GraphQL endpoints built on Elide

Discovery Timeline

2026-06-29 - CVE-2026-57954 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-57954

Vulnerability Analysis

Elide is a Java library that builds JSON:API and GraphQL web services from JPA-annotated data models. It enforces field-level access control through the @ReadPermission annotation, which restricts which fields a caller can read.

The vulnerability stems from the sort expression validation logic in SortingImpl.getValidSortingRules. This method validates that requested sort fields exist on the target entity but does not evaluate the @ReadPermission check against the requesting user. As a result, forbidden fields can still be used as sort keys in query parameters such as ?sort=hiddenField.

While the forbidden field values are never returned in the response body, the server returns rows ordered by those values. An attacker can iterate through sort operations and cross-reference visible identifiers to reconstruct relative ordering of the protected column across the entire collection.

Root Cause

The root cause is a missing authorization check [CWE-862] in the sort validation code path. Field existence is verified, but read permission enforcement is skipped. Any field defined on the entity model becomes a valid sort target regardless of the caller's granted permissions.

Attack Vector

Exploitation requires network access to an Elide-backed API and a valid low-privileged authentication token. The attacker issues repeated JSON:API or GraphQL read requests specifying the restricted field name in the sort parameter, then analyzes the row order to infer field values. No user interaction is required, and the attack is fully remote.

Refer to the VulnCheck Advisory on Elide and GitHub Issue #3415 for technical details.

Detection Methods for CVE-2026-57954

Indicators of Compromise

Repeated JSON:API requests containing sort= parameters that reference fields marked with @ReadPermission restrictions.
GraphQL queries specifying order or sort arguments naming fields not present in the response selection set.
Anomalous volumes of read requests from a single low-privileged account targeting the same collection with varying sort keys.

Detection Strategies

Log all sort expressions submitted to Elide endpoints and correlate them against the entity model to flag references to permission-restricted fields.
Instrument the SortingImpl class with wrapper logic to record when sort validation succeeds on a field the caller cannot read.
Deploy web application firewall rules that inspect sort, order_by, and GraphQL argument values against an allowlist of publicly readable fields.

Monitoring Recommendations

Alert on individual API tokens issuing high volumes of otherwise-identical queries that differ only in the sort parameter.
Track HTTP 200 responses to Elide collection endpoints where the sort key does not appear in the returned fields selection.
Retain application access logs with full query strings to support retrospective inference-attack analysis.

How to Mitigate CVE-2026-57954

Immediate Actions Required

Inventory all services built on the Elide framework and identify those running versions at or below 7.1.17.
Upgrade to a patched Elide release once available from the maintainers, referenced in GitHub Issue #3415.
Audit entity models to identify fields carrying @ReadPermission and treat them as high-risk targets for sort-based inference.
Rotate credentials for accounts observed submitting suspicious sort expressions.

Patch Information

At the time of publication, upstream tracking is available through GitHub Issue #3415. Administrators should monitor the Elide project releases for a version that enforces @ReadPermission inside SortingImpl.getValidSortingRules. Apply the patched release across all services once published.

Workarounds

Implement a request-layer filter or servlet interceptor that rejects any sort parameter referencing a field not present in an explicit allowlist per entity.
Restrict the exposed sort surface through Elide dictionary overrides so that only fields readable by all roles are eligible sort keys.
Apply rate limiting on collection endpoints to slow iterative inference attacks while a code fix is deployed.
Consider disabling client-controlled sorting on collections that contain fields protected by @ReadPermission until upgraded.

bash

# Example allowlist enforcement at the reverse proxy
# Reject any sort key not explicitly permitted for the /users collection
location /api/users {
    if ($arg_sort !~* "^(id|username|createdAt)?$") {
        return 400;
    }
    proxy_pass http://elide-backend;
}