Is CVE-2026-57954 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57954 being exploited in the wild.

How severe is CVE-2026-57954?

Medium severity, with a CVSS score of 4.3, published 29 June 2026.

Is there a fix for CVE-2026-57954?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-57954 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57954?

Check whether you run Yahoo Elide at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57954: Yahoo Elide missing authorization in SortingImpl sort expressions

CVE-2026-57954 · Severity: medium · CVSS 4.3 · Published 2026-06-29

Yahoo Elide, a Java library for building APIs, contains a security flaw that allows users to bypass data access restrictions. By manipulating how data is sorted in a request, an unauthorized user can infer the values of hidden or sensitive fields that they are not supposed to see. This could lead to the gradual exposure of private information through repeated, clever queries.

Vendors: Yahoo.

Quick answers

Is CVE-2026-57954 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57954 being exploited in the wild.
How severe is CVE-2026-57954?: Medium severity, with a CVSS score of 4.3, published 29 June 2026.
Which products and versions are affected?: Yahoo Elide through 7.1.17.
Is there a fix for CVE-2026-57954?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57954 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57954?: Check whether you run Yahoo Elide at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check exists in Elide's 'SortingImpl.getValidSortingRules' component. While Elide correctly enforces '@ReadPermission' on filter expressions, it fails to do so for sort expressions in both JSON:API and GraphQL read paths. An authenticated attacker can provide a sort expression referencing a forbidden field; although the field's value is not directly returned, the resulting row order allows the attacker to infer the relative ordering of sensitive data. By using 'guess and check' techniques or binary search via upserted boundary values, an attacker can reconstruct the exact values of unreadable fields. This is an incomplete fix of the logic originally addressed in CVE-2020-5289.

Affected products

Yahoo Elide through 7.1.17

Timeline

2026-06-29: disclosed
2026-06-29: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.