Executive brief
Yahoo Elide, a Java library for building APIs, contains a security flaw that allows users to bypass data access restrictions. By manipulating how data is sorted in a request, an unauthorized user can infer the values of hidden or sensitive fields that they are not supposed to see. This could lead to the gradual exposure of private information through repeated, clever queries.
Technical details
A missing authorization check exists in Elide's 'SortingImpl.getValidSortingRules' component. While Elide correctly enforces '@ReadPermission' on filter expressions, it fails to do so for sort expressions in both JSON:API and GraphQL read paths. An authenticated attacker can provide a sort expression referencing a forbidden field; although the field's value is not directly returned, the resulting row order allows the attacker to infer the relative ordering of sensitive data. By using 'guess and check' techniques or binary search via upserted boundary values, an attacker can reconstruct the exact values of unreadable fields. This is an incomplete fix of the logic originally addressed in CVE-2020-5289.
Affected products
- Yahoo Elide through 7.1.17
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory