CVE-2026-92681
Received Received - Intake

Authentication Bypass in Neo4j GraphQL Library

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Neo4j

Description
In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. An application that exposes a top-level @cypher field and relies on schema-level or type-level @authentication to protect it allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, which may permit reading and modifying data. Fixed in 7.6.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-92681
EUVD
EUVD-2026-97487

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Neo4j @neo4j/graphql 3.23.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the @neo4j/graphql library versions up to 7.6.3. Schema-level or type-level @authentication directives are ignored for top-level fields marked with @cypher. Only field-level @authentication annotations are enforced. This allows unauthenticated users to execute Cypher statements with the service account privileges, potentially reading or modifying data.

Detection Guidance

Check the version of @neo4j/graphql in use. If it is 7.6.3 or earlier, the system is vulnerable. Run 'npm list @neo4j/graphql' or inspect package.json to verify the installed version.

Impact Analysis

If you use @neo4j/graphql up to 7.6.3, unauthenticated attackers could access top-level @cypher fields, bypassing authentication checks. This may lead to unauthorized data access, modification, or deletion, depending on the Cypher statement permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Compliance may be compromised if sensitive data is exposed or altered without proper authentication.

Mitigation Strategies

Upgrade @neo4j/graphql to version 7.6.4 or later immediately. This version includes the fix for authentication enforcement on top-level @cypher fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart