Critical

Field-level access-control bypass for multiselect field

Disclosed: 18.10.2022
Updated: 11.10.2026 10:22

Impact

@keystone-6/core@2.2.0 || 2.3.0 users who are using the multiselect field, and provided field-level access control - are vulnerable to their field-level access control not being used.

List-level access control is NOT affected.

Field-level access control for fields other than multiselect are NOT affected.

Example, you are vulnerable if you are using field-level access control on a multiselect like the following:

const yourList = list({
  access: {
    // this is list-level access control, this is NOT impacted
  },
  fields: {
    yourFieldName: multiselect({
      // this is field-level access control, for multiselect fields
      //   this is vulnerable
      access: {
        create: ({ session }) => session?.data.isAdmin,
        update: ({ session }) => session?.data.isAdmin,
      },
      options: [
        { value: 'apples', label: 'Apples' },
        { value: 'oranges', label: 'Oranges' },
      ],
      // ...
    }),
    // ...
  },
  // ...
});

Mitigation

Please upgrade to @keystone-6/core >= 2.3.1, where this vulnerability has been closed.

Workarounds

If for some reason you cannot upgrade your dependencies, you should stop using the multiselect field.

Credits

Thanks to Marek R for reporting and submitting the pull request to fix this problem.

If you have any questions around this security advisory, please don't hesitate to contact us at security@keystonejs.com, or open an issue on GitHub.

If you have a security flaw to report for any software in this repository, please see our SECURITY policy.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	@keystone-6/core	>= 2.2.0, < 2.3.1	2.3.1

References

CVSS score 9.1/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-285, CWE-863
Platform: npm
Package: @keystone-6/core
Disclosed: 18.10.2022
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-6mhr-52mv-6v6f - CC BY 4.0

Vulnerability history: @keystone-6/core

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 8
First → latest: 10.2022 08.2026
Without a fix: 2
Exploited in attacks: 0

Severity breakdown

Critical 2
High 1
Medium 2
Low 3

Disclosures per year

2022: 2
2023: 2
2024: 0
2025: 1
2026: 3

21.08.2026

Keystone vulnerable to `graphql.maxTake` bypass with negative `take`

High · 7.5 CVE-2026-63421 < 6.5.3 6.5.3
04.06.2026

Keystone: GraphQL API Endpoint Lacks Query Depth Limits

Low · 4.3 CVE-2026-10802 <= 6.5.3 no fix
19.03.2026

@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)

Medium · 4.3 CVE-2026-33326 < 6.5.2 6.5.2
05.05.2025

Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields

Low · 3.1 CVE-2025-46720 < 6.5.0 6.5.0
15.08.2023

When `ui.isAccessAllowed` is `undefined`, the `adminMeta` GraphQL query is publicly accessible

Medium · 5.3 CVE-2023-40027 < 5.5.1 5.5.1
12.06.2023

@keystone-6/core's bundled cuid package known to be insecure

Low ghsa-5fp6-4xw3-xqq3 <= 5.3.1 no fix
03.11.2022

@keystone-6/core's NODE_ENV defaults to development with esbuild

Critical · 9.8 CVE-2022-39382 >= 3.0.0, < 3.0.2 3.0.2
18.10.2022

Field-level access-control bypass for multiselect field this entry

Critical · 9.1 CVE-2022-39322 >= 2.2.0, < 2.3.1 2.3.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application