CVE-2026-57954 describes a missing authorization enforcement in Yahoo Elide through version 7.1.17. Specifically, the @ReadPermission annotation is not enforced on client-supplied sort expressions in the SortingImpl.getValidSortingRules method. This flaw enables attackers to sort data collections by fields that are normally restricted, allowing them to infer hidden field values by analyzing the ordering of rows returned. Both JSON:API and GraphQL read interfaces are affected. No official remediation or patch information is provided in the available data.

Attackers can bypass read permission restrictions on sorting fields, enabling them to infer sensitive information about hidden fields by analyzing the order of rows in query results. This leakage occurs across all rows and affects both JSON:API and GraphQL endpoints. The vulnerability does not allow direct data access but leaks relative ordering information, which may aid in further information disclosure or reconnaissance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting client-supplied sorting or implementing additional access controls on sorting parameters to prevent unauthorized field sorting.