CVE-2026-33326
Description
Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 (field-level isFilterable bypass for update and delete mutations) added checks to the where parameter in update and delete mutations however the cursor parameter in findMany was not patched and accepts the same UniqueWhere input type. This issue has been patched in version 6.5.2.
How to fix
- keystonejs keystone6.5.2 or later
- @keystone-6/core6.5.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| keystonejs keystone | v < 6.5.2 | 6.5.2 |
| @keystone-6/corenpm | v < 6.5.2 | 6.5.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.