What is GHSA-c4g4-fg7q-8p3c?

GHSA-c4g4-fg7q-8p3c is a security advisory published by GitHub Security Advisories with Medium severity. Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in...

Which CVE IDs does GHSA-c4g4-fg7q-8p3c cover?

GHSA-c4g4-fg7q-8p3c covers the following CVE IDs: CVE-2026-57954. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c4g4-fg7q-8p3c?

GHSA-c4g4-fg7q-8p3c has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-c4g4-fg7q-8p3cMediumCVSS 4.3

Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in...

Vendor

GitHub Security Advisories

Published

June 29, 2026

Last Modified

June 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-57954 →

📋 Description

Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across all rows via both JSON:API and GraphQL read paths.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-57954
https://github.com/yahoo/elide/issues/3415
https://www.vulncheck.com/advisories/elide-permission-bypass-in-sort-expression-validation
https://github.com/advisories/GHSA-c4g4-fg7q-8p3c