Executive brief
Keystone is a headless CMS framework that uses access control rules to restrict which fields users can search or filter on. A security flaw allows authenticated attackers to bypass these restrictions by combining multiple filter conditions in update or delete operations, potentially revealing the existence or values of sensitive fields that should be hidden from them.
Technical details
The vulnerability is an access control bypass (CWE-200) in Keystone's field-level filtering mechanism. When a mutation (update or delete) includes a where clause with multiple unique filters (e.g., id and email), Keystone fails to fully enforce isFilterable or defaultIsFilterable restrictions; it attempts to match records even if filtering by secondary fields should be denied. This allows an authenticated attacker to use failed or successful filter results as an oracle to infer the presence or value of otherwise unreadable fields. The issue does not affect findMany operations or projects with isFilterable explicitly set to false. Keystone versions up to and including 6.4.0 are affected; the patch is available in version 6.5.0.
Affected products
- Keystone @keystone-6/core <=6.4.0
Timeline
- 2025-05-05: disclosed
- 2025-05-05: patched: Fixed in version 6.5.0