CVE-2022-39322

    Dashboard / Vulnerabilities / CVE-2022-39322

    CVE-2022-39322

    Published: 25 Oct 2022Last Modified: 28 Oct 2026

    Summary: @keystone-6/core vulnerable to field-level access-control bypass for multiselect field

    Details: @keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their `multiselect` fields to use the field-level access control - if configured - are vulnerable to their field-level access control not being used. List-level access control is not affected. Field-level access control for fields other than `multiselect` are not affected. Version 2.3.1 contains a fix for this issue. As a workaround, stop using the `multiselect` field.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39322.json, https://github.com/keystonejs/keystone/security/advisories/GHSA-6mhr-52mv-6v6f, https://nvd.nist.gov/vuln/detail/CVE-2022-39322, https://github.com/keystonejs/keystone/commit/65c6ee3deef23605fc72b80230908696a7a65e7c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e146f5a69eab84537afcde10ff571d4fd7cf4ffc
    Fixed -e586af45089a2ca1391d2a86ed585694b690b6c3

    Affected versions

    @keystone-alpha/[email protected]

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39322 | CVE-DB