# CVE-2025-46720: Keystone isFilterable bypass in update and delete mutations

Source: https://junglewise.ai/threats/cve-2025-46720-keystone-isfilterable-bypass-in-update-and-delete-mutations  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-05-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-46720 · Severity: low · CVSS 3.1 · Published 2025-05-05

Keystone is a headless CMS framework that uses access control rules to restrict which fields users can search or filter on. A security flaw allows authenticated attackers to bypass these restrictions by combining multiple filter conditions in update or delete operations, potentially revealing the existence or values of sensitive fields that should be hidden from them.

Technologies: [@keystone-6/core (npm)](https://junglewise.ai/threats/technologies/keystone-6-core). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-46720 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-46720 being exploited in the wild.

**How severe is CVE-2025-46720?** Low severity, with a CVSS score of 3.1, published 5 May 2025.

**Which products and versions are affected?** @keystone-6/core (npm) SEMVER:introduced=0,fixed=6.5.0.

**Is there a fix for CVE-2025-46720?** Yes. @keystone-6/core (npm): upgrade to 6.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-46720 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-46720?** Check whether you run @keystone-6/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @keystone-6/core (npm): upgrade to 6.5.0 or later

  ```sh
  npm install @keystone-6/core@6.5.0
  ```


## Technical details

The vulnerability is an access control bypass (CWE-200) in Keystone's field-level filtering mechanism. When a mutation (update or delete) includes a where clause with multiple unique filters (e.g., id and email), Keystone fails to fully enforce isFilterable or defaultIsFilterable restrictions; it attempts to match records even if filtering by secondary fields should be denied. This allows an authenticated attacker to use failed or successful filter results as an oracle to infer the presence or value of otherwise unreadable fields. The issue does not affect findMany operations or projects with isFilterable explicitly set to false. Keystone versions up to and including 6.4.0 are affected; the patch is available in version 6.5.0.

## Affected products

- Keystone @keystone-6/core <=6.4.0

## Identifiers

- CVE-2025-46720
- GHSA-hg9m-67mm-7pg3

## Timeline

- 2025-05-05: disclosed
- 2025-05-05: patched: Fixed in version 6.5.0

## References

- [https://github.com/keystonejs/keystone/security/advisories/GHSA-hg9m-67mm-7pg3](https://github.com/keystonejs/keystone/security/advisories/GHSA-hg9m-67mm-7pg3)

## Related threats

- [Keystone GraphQL maxTake bypass with negative values](https://junglewise.ai/threats/cve-2026-63421-keystone-graphql-maxtake-bypass-with-negative-values)
- [KeystoneJS Denial of Service via Unbounded GraphQL Query Depth](https://junglewise.ai/threats/cve-2026-10802-keystonejs-denial-of-service-via-unbounded-graphql-query-depth)
- [KeystoneJS @keystone-6/core authorization bypass in findMany cursor parameter](https://junglewise.ai/threats/cve-2026-33326-keystonejs-keystone-6-core-authorization-bypass-in-findmany)
- [Keystone @keystone-6/core unauthorized adminMeta GraphQL access](https://junglewise.ai/threats/cve-2023-40027-keystone-keystone-6-core-unauthorized-adminmeta-graphql-access)
- [Keystone-6 insecure cuid identifier dependency](https://junglewise.ai/threats/keystone-6-insecure-cuid-identifier-dependency-63b02e59)