Read the docs
TI-2026-71015 Aliases CVE-2026-92681

Authentication ignored for top-level @cypher fields in @neo4j/graphql

Priority MEDIUM 48CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

@neo4j/graphql from 3.23.0 before 7.6.4 ignores @authentication directives set at the schema level or on the Query or Mutation types for top-level fields annotated with @cypher. Only directives placed on the individual fields are enforced (CWE-306). An unauthenticated remote attacker can invoke such a field and run its Cypher statement with the privileges of the GraphQL service account, which may allow reading and modifying data.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. An application that exposes a top-level @cypher field and relies on schema-level or type-level @authentication to protect it allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, which may permit reading and modifying data. Fixed in 7.6.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0037 31st percentileScored 2026-11-07
Fix Fixed @neo4j/graphql (Neo4j): 7.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
neo4j@neo4j/graphql3.23.0 to before 7.6.47.6.4Patch availableCNA
  • @neo4j/graphql Vendorneo4j Affected 3.23.0 to before 7.6.4 Fixed in 7.6.4 Patch available CNA

Remediation

Upgrade @neo4j/graphql to version 7.6.4, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA @neo4j/graphql (Neo4j) Fixed in 7.6.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Neo4j @neo4j/graphql 7.6.4

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-71016 Inverted none quantifier in @neo4j/graphql authorization filtersPriority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-92681
  2. 2026-10-16 CISA SSVC decision points changed

References

Patch 1

Advisory 1

Other 2

  • TI-2021-13406 Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that… CVSS 3.1CRITICAL 9.8
  • TI-2018-16042 neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External… CVSS 3.0CRITICAL 10.0
  • TI-2018-13005 Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9… CVSS 3.0CRITICAL 9.8
  • TI-2021-18971 A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before… CVSS 3.1CRITICAL 9.1
  • TI-2026-01049 Insufficient escaping of unicode characters in query log CVSS 4.0LOW 1.1
  • TI-2021-13798 A failure in resetting the security context in some transaction actions in Neo4j Graph… CVSS 3.1HIGH 8.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences