Skip to content
OpenAdvisories

Vendor

keystonejs

10 known vulnerabilities.

Products

keystone 8 keystone-5 1 keystonejs/keystone 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.1
    CVE-2025-46720

    Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields

    Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `update` and `delete` mutations by adding additional unique filters. These filters can be used as an oracle to probe the exis…

    keystonejs keystone @keystone-6/core npm
  • Low 3.7
    CVE-2023-40027

    Conditionally missing authorization in @keystone-6/core

    Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `adminMeta` GraphQL query is publicly accessible (no session required). This is different to the behaviour of the default …

    keystonejs keystone @keystone-6/core npm