CVE-2026-33326
published 2026-03-24CVE-2026-33326: Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.26%
17.0th percentile
Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 (field-level isFilterable bypass for update and delete mutations) added checks to the where parameter in update and delete mutations however the cursor parameter in findMany was not patched and accepts the same UniqueWhere input type. This issue has been patched in version 6.5.2.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| keystone-6 | core | >= 0 < 6.5.2 | 6.5.2 |
| keystonejs | keystone | < 6.5.2 | 6.5.2 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
ghsa4.3MEDIUM
osv4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
keystone up to 6.5.1 update/delete where authorization
vuldb·2026-05-06·CVSS 4.3
CVE-2026-33326 [MEDIUM] keystone up to 6.5.1 update/delete where authorization
A vulnerability, which was classified as problematic, was found in keystone up to 6.5.1. Affected by this vulnerability is the function update/delete. Executing a manipulation of the argument where can lead to incorrect authorization.
This vulnerability appears as CVE-2026-33326. The attack may be performed from remote. There is no available exploit.
You should upgrade the affected component.
GHSA
@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)
ghsa·2026-03-19·CVSS 4.3
CVE-2026-33326 [MEDIUM] CWE-863 @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)
@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)
# Summary
`{field}.isFilterable` access control can be bypassed in `findMany` queries by passing a `cursor`. This can be used to confirm the existence of records by protected field values.
The fix for [CVE-2025-46720](https://github.com/keystonejs/keystone/security/advisories/GHSA-hg9m-67mm-7pg3) (field-level `isFilterable` bypass for update and delete mutations) added checks to the `where` parameter in `update` and `delete` mutations however the `cursor` parameter in `findMany` was not patched and accepts the same `UniqueWhere` input type.
# Impact
This affects any project relying on `isFilterable` behaviour (at the list or field level) to prevent external users from using the fil
OSV
@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)
osv·2026-03-19·CVSS 4.3
CVE-2026-33326 [MEDIUM] @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)
@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)
# Summary
`{field}.isFilterable` access control can be bypassed in `findMany` queries by passing a `cursor`. This can be used to confirm the existence of records by protected field values.
The fix for [CVE-2025-46720](https://github.com/keystonejs/keystone/security/advisories/GHSA-hg9m-67mm-7pg3) (field-level `isFilterable` bypass for update and delete mutations) added checks to the `where` parameter in `update` and `delete` mutations however the `cursor` parameter in `findMany` was not patched and accepts the same `UniqueWhere` input type.
# Impact
This affects any project relying on `isFilterable` behaviour (at the list or field level) to prevent external users from using the fil
No detection rules found.
No public exploits indexed.
2026-03-24
Published