Keystone's findMany GraphQL resolver incorrectly compares a signed take argument with the configured graphql.maxTake. A negative take value whose magnitude exceeds the bound bypasses the limit, allowing an unauthenticated remote client to request far more records than intended. This can expose data that should be restricted and can consume excessive CPU or memory, leading to resource exhaustion.

Keystone, a Node.js content management system, is affected on any installation using an unreleased version prior to 6.5.3. The vulnerability exists in the core resolver logic and applies to relationship queries that rely on the same take validation. All versions before the 6.5.3 release are at risk.

The CVSS base score of 7.5 indicates a significant severity, while the EPSS score is not available and the vulnerability is not in CISA KEV. Attackers can exploit this remotely through the public GraphQL endpoint without authentication. Because the bypass allows retrieval of an arbitrary large dataset, it can quickly overwhelm application resources and potentially expose sensitive information.