Read the docs
TI-2026-01214 Aliases CVE-2026-1524GHSA-5pgp-mc2w-hjjx

Auth misconfiguration when multiple providers enabled

Priority LOW 11CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider. When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.  We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00366 30th percentileScored 2026-11-07
Fix Fixed Enterprise Edition (neo4j): 5.26.22, 2026.02

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
neo4jEnterprise Edition4.4.0 to before 5.26.22; 2025.01 to before 2026.025.26.22, 2026.02Patch availableCNA
  • Enterprise Edition Vendorneo4j Affected 4.4.0 to before 5.26.22; 2025.01 to before 2026.02 Fixed in 5.26.22, 2026.02 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:*before 5.26.22; 2025.01.0 to before 2026.02.0Vulnerableneo4j
  • cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:* Versions before 5.26.22; 2025.01.0 to before 2026.02.0 Vulnerable ·neo4j

Remediation

  • Fix · CNA Enterprise Edition (neo4j) Fixed in 5.26.22, 2026.02

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    neo4j Enterprise Edition 2026.02, 5.26.22

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-01192 Incorrect privilege assignment in composite databasesPriority LOW 19
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1524
  2. 2026-10-03 Alias added: GHSA-5pgp-mc2w-hjjx

References

Advisory 1

  • TI-2021-13406 Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that… CVSS 3.1CRITICAL 9.8
  • TI-2018-13005 Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9… CVSS 3.0CRITICAL 9.8
  • TI-2026-01049 Insufficient escaping of unicode characters in query log CVSS 4.0LOW 1.1
  • TI-2013-05927 Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote… CVSS 2.0MEDIUM 6.8
  • TI-2026-12296 Unathenticated connection can hold Bolt channel open CVSS 4.0MEDIUM 5.5
  • TI-2024-22827 Improper privilege management in Neo4j CVSS 3.1MEDIUM 6.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences