Read the docs
TI-2026-01192 Aliases CVE-2026-1497GHSA-pr32-4ghw-rwcv

Incorrect privilege assignment in composite databases

Priority LOW 19CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario:  an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database or alias doesn't exist when the command is run, the privileges will apply if it's created in the future.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00273 19th percentileScored 2026-11-07
Fix Fixed Enterprise Edition (neo4j): 5.26.22, 2026.02

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
neo4jEnterprise Edition5.0 to before 5.26.22; 2025.01 to before 2026.025.26.22, 2026.02Patch availableCNA
  • Enterprise Edition Vendorneo4j Affected 5.0 to before 5.26.22; 2025.01 to before 2026.02 Fixed in 5.26.22, 2026.02 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:*before 5.26.22; 2025.01.0 to before 2026.02.0Vulnerableneo4j
  • cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:* Versions before 5.26.22; 2025.01.0 to before 2026.02.0 Vulnerable ·neo4j

Remediation

  • Fix · CNA Enterprise Edition (neo4j) Fixed in 5.26.22, 2026.02

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    neo4j Enterprise Edition 2026.02, 5.26.22

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-01214 Auth misconfiguration when multiple providers enabledPriority LOW 11
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1497
  2. 2026-10-03 Alias added: GHSA-pr32-4ghw-rwcv

References

Advisory 1

  • TI-2021-13406 Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that… CVSS 3.1CRITICAL 9.8
  • TI-2018-13005 Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9… CVSS 3.0CRITICAL 9.8
  • TI-2026-01049 Insufficient escaping of unicode characters in query log CVSS 4.0LOW 1.1
  • TI-2013-05927 Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote… CVSS 2.0MEDIUM 6.8
  • TI-2026-12296 Unathenticated connection can hold Bolt channel open CVSS 4.0MEDIUM 5.5
  • TI-2024-22827 Improper privilege management in Neo4j CVSS 3.1MEDIUM 6.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences