keystonejs/keystone 2026-03-19

19 March 2026

on GitHub

The following packages have been updated

@keystone-6/core@6.5.2

Bug Fixes

• [core] Fix isFilterable bypass via cursor parameter in findMany query (#9790) @n0wsh

🚨 Security Updates

We have identified and fixed 1 security vulnerability

• CVE-2026-33326 - {field}.isFilterable access control could be bypassed in findMany queries by passing a cursor. This could be used to confirm the existence of records by protected field values.

👀 Review

See 2025-05-06...2026-03-19 to compare with our previous release.