CVE-2026-57954

mediumCVSS 4.3covered by 1 sourcefirst seen 2026-06-29

Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across all rows via both JSON:API and GraphQL read paths.

⚡ Watch CVE-2026-57954

Get an email if CVE-2026-57954 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-57954: Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in S…nvd · 2026-06-29

External references

NVD record for CVE-2026-57954

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-57954 status](https://www.csirts.com/badge/CVE-2026-57954)](https://www.csirts.com/cve/CVE-2026-57954)