{"id":"CVE-2022-39322","aliases":["GHSA-6mhr-52mv-6v6f"],"url":"https://o3.security/vulnerability/CVE-2022-39322","summary":"@keystone-6/core vulnerable to field-level access-control bypass for multiselect field","details":"#### Impact\n\n`@keystone-6/core@2.2.0 || 2.3.0` users who are using the `multiselect` field, and provided field-level access control - are vulnerable to their field-level access control not being used.\n\nList-level access control is **NOT** affected.\n\nField-level access control for fields other than `multiselect` are **NOT** affected.\n\nExample, **you are vulnerable if** you are using field-level access control on a `multiselect` like the following:\n```ts\nconst yourList = list({\n  access: {\n    // this is list-level access control, this is NOT impacted\n  },\n  fields: {\n    yourFieldName: multiselect({\n      // this is field-level access control, for multiselect fields\n      //   this is vulnerable\n      access: {\n        create: ({ session }) => session?.data.isAdmin,\n        update: ({ session }) => session?.data.isAdmin,\n      },\n      options: [\n        { value: 'apples', label: 'Apples' },\n        { value: 'oranges', label: 'Oranges' },\n      ],\n      // ...\n    }),\n    // ...\n  },\n  // ...\n});\n```\n\n#### Mitigation\nPlease upgrade to `@keystone-6/core >= 2.3.1`, where this vulnerability has been closed.\n\n#### Workarounds\nIf for some reason you cannot upgrade your dependencies, you should stop using the `multiselect` field.\n\n#### Credits\nThanks to [Marek R](https://github.com/marekryb) for reporting and submitting the pull request to fix this problem.\n\nIf you have any questions around this security advisory, please don't hesitate to contact us at [security@keystonejs.com](mailto:security@keystonejs.com), or [open an issue on GitHub](https://github.com/keystonejs/keystone/issues/new/choose).\n\nIf you have a security flaw to report for any software in this repository, please see our [SECURITY policy](https://github.com/keystonejs/keystone/blob/main/SECURITY.md).","published":"2022-10-25T00:00:00Z","modified":"2026-08-12T03:51:14.039462653Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":{"score":0.01085,"percentile":0.62249,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"@keystone-6/core","fixedVersion":"2.3.1"}],"fix":{"url":"https://github.com/keystonejs/keystone/commit/65c6ee3deef23605fc72b80230908696a7a65e7c","label":"keystonejs/keystone@65c6ee3"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39322.json"},{"type":"ADVISORY","url":"https://github.com/keystonejs/keystone/security/advisories/GHSA-6mhr-52mv-6v6f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39322"},{"type":"FIX","url":"https://github.com/keystonejs/keystone/commit/65c6ee3deef23605fc72b80230908696a7a65e7c"},{"type":"PACKAGE","url":"https://github.com/keystonejs/keystone"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:14.039462653Z"}}