CVE-2026-33326 Details
Description
Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 (field-level isFilterable bypass for update and delete mutations) added checks to the where parameter in update and delete mutations however the cursor parameter in findMany was not patched and accepts the same UniqueWhere input type. This issue has been patched in version 6.5.2.
An access control bypass vulnerability has been identified in Keystone, a Node.js content management system, prior to version 6.5.2. The issue arises in 'findMany' queries, where '{field}.isFilterable' access control can be circumvented by using a cursor. This exploitation allows confirmation of record existence based on protected field values. Although the update and delete mutations were patched to address a similar vulnerability (CVE-2025-46720), the 'findMany' cursor parameter remained vulnerable, accepting the same 'UniqueWhere' input type.
Users can upgrade to Keystone version 6.5.2 or later to address this vulnerability. In projects using an older version where an upgrade is not possible, relevant fields can be set to '{field}.isFilterable: false' or '{field}.graphql.omit.read: true' to mitigate the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/keystonejs/keystone/security/advisories/GHSA-cgcg-q9jh-5pr2 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| keystonejs keystone | < 6.5.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | Initial Analysis | [email protected] |
| Mar 24, 2026 | New CVE Received | [email protected] |