CVE-2022-39322: 
JavaScript vulnerability analysis and mitigation

@keystone-6/core, a core package for Keystone 6 content management system for Node.js, contained a vulnerability in versions 2.2.0 through 2.3.0 where field-level access control for multiselect fields could be bypassed. The vulnerability was discovered and disclosed in October 2022, affecting applications using multiselect fields with field-level access control configurations (GitHub Advisory).

The vulnerability exists in the multiselect field type implementation where the field-level access control configurations were not being properly propagated and enforced. This security flaw received a CVSS v3.1 base score of 9.1 (Critical), with attack vector being Network, attack complexity Low, requiring no privileges or user interaction, and affecting both confidentiality and integrity (GitHub Advisory).

The vulnerability allows unauthorized users to bypass field-level access control restrictions specifically for multiselect fields, potentially leading to unauthorized data access and modification. While list-level access control and other field types remained unaffected, any multiselect field with custom access control configurations could be compromised (GitHub Advisory).

The vulnerability was patched in version 2.3.1 of @keystone-6/core. Users are strongly advised to upgrade to this version or later. If immediate upgrading is not possible, the recommended workaround is to stop using the multiselect field type until the upgrade can be performed (GitHub Advisory).