EUVD-2026-40139
GHSA-c4g4-fg7q-8p3c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint requires authenticated access (PR:L); only partial confidentiality disclosed via ordering side-channel (C:L); no integrity or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across all rows via both JSON:API and GraphQL read paths.
AnalysisAI
Sort-expression permission bypass in Yahoo Elide through 7.1.17 allows authenticated network attackers to leak relative values of @ReadPermission-protected fields by sorting API collections on forbidden field names. The flaw exists in SortingImpl.getValidSortingRules, which accepts client-controlled sort keys without verifying the caller's read authorization, exposing a classic side-channel across both JSON:API and GraphQL read endpoints. No public exploit code has been identified and no CISA KEV listing exists, but the attack is low-complexity for any authenticated user on an affected deployment.
Technical ContextAI
Elide is a Yahoo-originated Java framework that auto-generates JSON:API and GraphQL APIs from annotated JPA data models. It implements field-level access control via annotations such as @ReadPermission, which restrict which principals can read specific model attributes. The vulnerability resides in SortingImpl.getValidSortingRules, the server-side method responsible for validating client-supplied sort parameters before executing queries. Per CWE-862 (Missing Authorization), this code path executes a security-sensitive operation - using a restricted field as a database sort key - without first checking whether the requesting principal holds the necessary @ReadPermission on that field. The resulting side-channel is a well-documented class of information leak: even though the protected field values are not returned in the API response body, the relative ordering of returned rows directly encodes those values, permitting binary-search-style inference of hidden data across all rows in the collection.
RemediationAI
The primary remediation is to upgrade Elide beyond version 7.1.17 once a patched release is published; no exact fix version was confirmed in the available input data, and no vendor-released patch version has been independently verified. Monitor the upstream GitHub issue at https://github.com/yahoo/elide/issues/3415 and the VulnCheck advisory at https://www.vulncheck.com/advisories/elide-permission-bypass-in-sort-expression-validation for patch announcements. As a compensating control, operators can implement a request filter or Elide middleware layer that validates sort parameter field names against the authenticated principal's permissions before the request reaches SortingImpl - this adds maintenance burden as the data model evolves. Alternatively, API gateway rules can reject sort parameters referencing known sensitive field names by name; this is brittle against schema changes but immediately deployable. Disabling client-controlled sorting on collections containing @ReadPermission-restricted fields eliminates the vector entirely at the cost of sort functionality. No other compensating controls can fully substitute for a code-level fix in SortingImpl.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today