CVE-2026-92682
Received Received - Intake

Authorization Bypass in Neo4j GraphQL Library

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Neo4j

Description
In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-92682
EUVD
EUVD-2026-97486

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Neo4j @neo4j/graphql 7.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

In @neo4j/graphql versions 7.0.0 to 7.6.3, the none quantifier in @authorization filters on relationships and connections is incorrectly translated to Cypher. Instead of negating the quantifier, it behaves like some, causing authorization rules to work in reverse. For example, a rule meant to deny access to records if none of the related users match the JWT subject will instead return those records and exclude others. This allows authenticated users to read, create, or delete protected data despite authorization rules.

Detection Guidance

Check the installed version of @neo4j/graphql. If it is between 7.0.0 and 7.6.3, the system is vulnerable. Run: npm list @neo4j/graphql to verify the version.

Impact Analysis

This vulnerability allows authenticated users to bypass authorization rules and access, modify, or delete data they are not permitted to see or change. Sensitive data could be exposed, altered, or deleted by unauthorized users, leading to data breaches, integrity issues, or compliance violations. The impact is significant for applications relying on @neo4j/graphql for data access control.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating regulations like GDPR (data protection) and HIPAA (healthcare data privacy). Non-compliance may result in legal penalties, fines, or reputational damage due to exposed or altered sensitive information.

Mitigation Strategies

Upgrade @neo4j/graphql to version 7.6.4 or later immediately. This fixes the authorization filter issue. Run: npm update @neo4j/graphql@7.6.4 to apply the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92682. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart