Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M

CVE-2026-33326@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany

Medium 4.3

In plain English

A medium-severity incorrect authorization in keystone from keystonejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 81.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 (field-level isFilterable bypass for update and delete mutations) added checks to the where parameter in update and delete mutations however the cursor parameter in findMany was not patched and accepts the same UniqueWhere input type. This issue has been patched in version 6.5.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@keystone-6/core	6.5.2	GHSA-cgcg-q9jh-5pr2

Affected products (as reported)

Vendor	Product	Versions
keystonejs	keystone	< 6.5.2

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/keystonejs/keystone/security/advisories/GHSA-cgcg-q9jh-5pr2 x_refsource_CONFIRM