CVE-2026-33326

Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 (field-level isFilterable bypass for update and delete mutations) added checks to the where parameter in update and delete mutations however the cursor parameter in findMany was not patched and accepts the same UniqueWhere input type. This issue has been patched in version 6.5.2.

• CWE-863

• https://github.com/keystonejs/keystone/security/advisories/GHSA-cgcg-q9jh-5pr2Vendor Advisory

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3332The Xhanch - My Advanced Settings plugin for WordPress is vu…4.3
• CVE-2026-33320Dasel is a command-line tool and library for querying, modif…6.2
• CVE-2026-33321OpenEMR is a free and open source electronic health records …7.6
• CVE-2026-33322MinIO is a high-performance object storage system. From RELE…9.8
• CVE-2026-33323Parse Server is an open source backend that can be deployed …5.3
• CVE-2026-33324SQLBot is an intelligent Text-to-SQL system based on large l…8.8
• CVE-2026-33327libvips is a fast image processing library with low memory n…7
• CVE-2026-33328libvips is a fast image processing library with low memory n…6.8
• CVE-2026-33329FileRise is a self-hosted web file manager / WebDAV server. …8.1
• CVE-2026-3333The MinhNhut Link Gateway plugin for WordPress is vulnerable…6.4
• CVE-2026-33330FileRise is a self-hosted web file manager / WebDAV server. …7.1
• CVE-2026-33331oRPC is an tool that helps build APIs that are end-to-end ty…5.4