{"metadata": {"vulnerability": "CVE-2025-46720", "count": 13, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2025-04-28T20:56:09.084Z", "date_only": false, "value": "2025-04-28T20:56:09.084Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-46720", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-05-05T18:51:34Z", "date_only": false, "value": "2025-05-05T18:51:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HG9M-67MM-7PG3", "record": "GHSA-HG9M-67MM-7PG3", "field": "published"}, {"timestamp": "2025-05-05T18:53:51.506Z", "date_only": false, "value": "2025-05-05T18:53:51.506Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-46720", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-05-05T18:53:51.506Z", "date_only": false, "value": "2025-05-05T18:53:51.506Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2025-46720", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-05-05T18:59:54.605Z", "date_only": false, "value": "2025-05-05T18:59:54.605898Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-46720", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-05-05T18:59:54.605Z", "date_only": false, "value": "2025-05-05T18:59:54.605898Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-46720", "record": "FKIE_CVE-2025-46720", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-05-05T19:00:01.531Z", "date_only": false, "value": "2025-05-05T19:00:01.531Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-46720", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-05-05T19:00:01.531Z", "date_only": false, "value": "2025-05-05T19:00:01.531Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-46720", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-05-05T19:15:57Z", "date_only": false, "value": "2025-05-05T19:15:57Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HG9M-67MM-7PG3", "record": "GHSA-HG9M-67MM-7PG3", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-05-05T19:15:57.330Z", "date_only": false, "value": "2025-05-05T19:15:57.330", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-46720", "record": "FKIE_CVE-2025-46720", "field": "published"}, {"timestamp": "2025-05-05T21:44:13Z", "date_only": false, "value": "2025-05-05T21:44:13.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/24478", "record": "CVE-2025-46720", "field": "creation_timestamp", "uuid": "19a1431b-4763-40eb-b247-672836996314", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-46720 - Keystone Node.js Oracle Filter Bypass\", \n  \"Content\": \"CVE ID : CVE-2025-46720 \nPublished : May 5, 2025, 7:15 p.m. | 20\u00a0minutes ago \nDescription : Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `update` and `delete` mutations by adding additional unique filters. These filters can be used as an oracle to probe the existence or value of otherwise unreadable fields. Specifically, when a mutation includes a `where` clause with multiple unique filters (e.g. `id` and `email`), Keystone will attempt to match records even if filtering by the latter fields would normally be rejected by `field.isFilterable` or `list.defaultIsFilterable`. This can allow malicious actors to infer the presence of a particular field value when a filter is successful in returning a result. This affects any project relying on the default or dynamic `isFilterable` behavior (at the list or field level) to prevent external users from using the filtering of fields as a discovery mechanism. While this access control is respected during `findMany` operations, it was not completely enforced during `update` and `delete` mutations when accepting more than one unique `where` values in filters. This has no impact on projects using `isFilterable: false` or `defaultIsFilterable: false` for sensitive fields, or for those who have otherwise omitted filtering by these fields from their GraphQL schema. This issue has been patched in `@keystone-6/core` version 6.5.0. To mitigate this issue in older versions where patching is not a viable pathway, set `isFilterable: false` statically for relevant fields to prevent filtering by them earlier in the access control pipeline (that is, don't use functions); set `{field}.graphql.omit.read: true` for relevant fields, which implicitly removes filtering by these fields from the GraphQL schema; and/or deny `update` and `delete` operations for the relevant lists completely. \nSeverity: 3.1 | LOW \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 May 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/24478"}, {"timestamp": "2025-05-05T22:06:50Z", "date_only": false, "value": "2025-05-05T22:06:50Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HG9M-67MM-7PG3", "record": "GHSA-HG9M-67MM-7PG3", "field": "modified"}, {"timestamp": "2026-06-17T09:26:52.347Z", "date_only": false, "value": "2026-06-17T09:26:52.347", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-46720", "record": "FKIE_CVE-2025-46720", "field": "lastModified"}]}