Critical · published October 25, 2022
🚨 A sneaky access control flaw is letting your multiselect fields slip through the cracks! 🔥 Think of it like a fancy restaurant where the chef forgot to put a filter on the ingredient list, allowing anyone backstage to grab whatever they want instead of just their assigned dish. Your users might access data they shouldn’t, thanks to this oversight! An attacker could potentially view or manipulate data in multiselect fields that should've been off-limits. This could lead to significant data exposure and manipulation, putting sensitive information at risk. The consequences could be absolutely devastating for your system's integrity!
Think of it like a fancy restaurant where the chef forgot to put a filter on the ingredient list, allowing anyone backstage to grab whatever they want instead of just their assigned dish. Your users might access data they shouldn’t, thanks to this oversight! This vulnerability in @keystone-6/core allows the field-level access control to be bypassed for multiselect fields, meaning that even if configured, the control does not function as intended. Only list-level access control is unaffected, leaving a gap where sensitive data might be accessed.
An attacker could potentially view or manipulate data in multiselect fields that should've been off-limits. This could lead to significant data exposure and manipulation, putting sensitive information at risk. The consequences could be absolutely devastating for your system's integrity! To protect your application, immediately update @keystone-6/core to version 2.3.1, which addresses this flaw. As a temporary measure, consider avoiding the use of multiselect fields until you're patched. Always ensure your access controls are thoroughly configured! You’ve got this! By taking these steps, you'll ensure your app remains secure and protect your users’ data. 🛡️