Access Control Bypass in Keystone Content Management System for Node.js
CVE-2025-46720

3.1LOW

Key Information:

Vendor

Keystonejs

Status
Keystone
Vendor
CVE Published:
5 May 2025

What is CVE-2025-46720?

Keystone is a content management system built for Node.js, which is impacted by a vulnerability allowing access control to be bypassed during update and delete mutations. Prior to version 6.5.0, malicious users could leverage unique filters in GraphQL queries to infer the existence and value of otherwise protected fields. This vulnerability arises because Keystone improperly handles the isFilterable property in these mutations, potentially enabling attackers to probe for sensitive data through successful filter matches. Although the issue does not affect projects utilizing 'isFilterable: false', developers are advised to upgrade to the patched version 6.5.0 or implement mitigating measures, such as disabling filtering for vulnerable fields.

Affected Version(s)

keystone < 6.5.0

References

https://github.com/keystonejs/keystone/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.