Read permissions not enforced for client provided filter expressions in Elide.

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

EPSS

• CVE-2020-5289: 1.25% estimated exploitation activity in the next 30 days; percentile 69.44 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact It is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. For example, a User model has two fields: name and role. The adversary has read permissions to see the name field of the User collection but not the role. By constructing a filter like the one below, the adversary can determine which users have admin role by presence or absence in the returned collection: filter=role=="Admin" Patches Resolved in Elide 4.5.14 and greater. Workarounds The adversary can only access the fields if a model includes fields with different read permission levels (some less secure and some more secure). Model security can be adjusted by restricting read permissions on…

Published by the source

30 Mar 2020, 20:09 UTC

Last modified by the source

9 Jan 2023, 05:02 UTC

Source last checked

26 Oct 2026, 15:52 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-2mxr-89gf-rc4v

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2020-5289

Advisory: Read permissions not enforced for client provided filter expressions in Elide.
IDs: CVE-2020-5289, GHSA-2mxr-89gf-rc4v
Record: https://patchnext.com/advisories/cve-2020-5289 (revision 1, source checked 26 Oct 2026, 15:52 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: com.yahoo.elide:elide-core 4.5.14. A vendor fix does not mean a deployment is fixed.

## Affected components
- Maven com.yahoo.elide:elide-core: affected < 4.5.14; fixed in 4.5.14

## Suggested inspection (read-only)
- Maven com.yahoo.elide:elide-core: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on com.yahoo.elide:elide-core.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-2mxr-89gf-rc4v (GitHub-reviewed advisory GHSA-2mxr-89gf-rc4v lists affected ranges: Maven com.yahoo.elide:elide-core >=0 <4.5.14)

Commands are suggestions: review each one before running it.