CVE-2026-33326 @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany

What is CVE-2026-33326?

CVE-2026-33326 is a medium-severity missing authorization vulnerability in keystonejs keystone, published on 24 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 (field-level isFilterable bypass for update and delete mutations) added checks to the where parameter in update and delete mutations however the cursor parameter in findMany was not patched and accepts the same UniqueWhere input type. This issue has been patched in version 6.5.2.

Weakness: CWE-863

Which versions are affected by CVE-2026-33326?

2 open source packages ship an affected version, including @keystone-6/core. It affects 1 product.

Products include Keystonejs Keystone.

How do I fix CVE-2026-33326?

Upgrade @keystone-6/core to 6.5.2 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-33326 being exploited?

There is no known exploitation of CVE-2026-33326 in the wild and no public exploit code.

Other vulnerabilities in keystonejs keystone

• CVE-2022-39382 NODE_ENV in Keystone defaults to development with esbuild Critical 9.8
• CVE-2022-29354 File upload in n/a Critical 9.8
• CVE-2022-39322 @keystone-6/core vulnerable to field-level access-control bypass for multiselect field Critical 9.1
• CVE-2017-16570 Cross-Site Request Forgery (CSRF) in keystone High 8.8
• CVE-2017-15879 Keystone is vulnerable to CSV injection High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cgcg-q9jh-5pr2.