Read the docs
TI-2025-11674 Aliases CVE-2025-12738GHSA-qcj4-rf2h-2w2x

Enumeration of restricted property value

Priority LOW 8CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property to infer information about its value by trying to enumerate all possible values through observing error messages of SET property. We recommend upgrading to 2025.11.2 or 5.26.17 and above, where the issues is fixed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00392 33rd percentileScored 2026-11-07
Fix Fixed Enterprise Edition (neo4j): 2025.11.2, 5.26.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
neo4jEnterprise Editionbefore 2025.11.2; before 5.26.172025.11.2, 5.26.17Patch availableCNA
  • Enterprise Edition Vendorneo4j Affected before 2025.11.2; before 5.26.17 Fixed in 2025.11.2, 5.26.17 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:neo4j:neo4j:*:*:*:*:*:*:*:*——neo4j
  • cpe:2.3:a:neo4j:neo4j:*:*:*:*:*:*:*:* Versions — — ·neo4j

Remediation

  • Fix · CNA Enterprise Edition (neo4j) Fixed in 2025.11.2, 5.26.17

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-12738
  2. 2026-10-03 Alias added: GHSA-qcj4-rf2h-2w2x

References

Advisory 1

  • TI-2021-13406 Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that… CVSS 3.1CRITICAL 9.8
  • TI-2026-71015 Authentication ignored for top-level @cypher fields in @neo4j/graphql CVSS 4.0CRITICAL 9.3
  • TI-2018-16042 neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External… CVSS 3.0CRITICAL 10.0
  • TI-2018-13005 Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9… CVSS 3.0CRITICAL 9.8
  • TI-2021-18971 A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before… CVSS 3.1CRITICAL 9.1
  • TI-2026-01049 Insufficient escaping of unicode characters in query log CVSS 4.0LOW 1.1
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences