Executive Summary

This vulnerability affects Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17. An attacker who has some legitimate access to the database but does not have read access to a specific property can infer information about that property's value. They do this by enumerating all possible values and observing error messages generated when attempting to set the property. This leads to potential information disclosure.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized information disclosure. An attacker with limited access can infer sensitive data values they are not authorized to read by exploiting error messages during property setting attempts. This could compromise data confidentiality within the database.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Neo4j Enterprise edition to version 2025.11.2 or 5.26.17 or above, where the vulnerability is fixed.

Useful 0 Not Useful 0