Keystone, a Node.js content management system, has a weakness where the isFilterable check on protected fields can be overridden in findMany queries when a cursor parameter is supplied. This oversight, classified as CWE-863, lets an attacker confirm the existence of records that match specific protected field values, effectively bypassing intended access controls without altering any data.

The vulnerability affects keystonejs Keystone versions prior to 6.5.2. Any deployment of Keystone 6 using its default data layer can be impacted if findMany queries are exposed through an API endpoint. No other vendors or products are listed as affected.

The CVSS score of 4.3 indicates moderate severity, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. While EPSS data is unavailable, the issue can be exploited over the network by an attacker who can send a properly crafted findMany request with a cursor argument. Successful exploitation would allow enumeration of protected data but does not provide direct code execution or privilege escalation.