Executive brief
@keystone-6/core is a Node.js GraphQL backend framework used to build CMS and data-driven applications. An authorization bypass vulnerability allows authenticated users to discover protected records by using a cursor parameter in findMany queries, bypassing field-level access controls that should restrict filtering on sensitive fields.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the findMany GraphQL query handler. The cursor parameter accepts a UniqueWhere input type that was not subjected to the same isFilterable access control checks that were added to update and delete mutations in the previous CVE-2025-46720 fix. An authenticated attacker (PR:L) can craft findMany queries with cursor values that reference protected fields to confirm the existence of records without having permission to filter by those fields. This is a network-reachable attack with no user interaction required. The vulnerability has been patched in version 6.5.2; prior versions up to 6.5.1 are affected.
Affected products
- KeystoneJS @keystone-6/core <= 6.5.1
Timeline
- 2026-03-19: disclosed
- 2026-03-19: patched: version 6.5.2