Read the docs
TI-2026-71016 Aliases CVE-2026-92682

Inverted none quantifier in @neo4j/graphql authorization filters

Priority LOW 39CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

@neo4j/graphql from 7.0.0 before 7.6.4 translates the none quantifier in @authorization relationship and connection filters into Cypher without negating it, so it behaves like some. This incorrect authorization (CWE-863) makes rules return the records they should exclude and exclude the records they should return. An authenticated user that a rule is meant to deny can read protected records and also create or delete them through mutations.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed @neo4j/graphql (Neo4j): 7.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
neo4j@neo4j/graphql7.0.0 to before 7.6.47.6.4Patch availableCNA
  • @neo4j/graphql Vendorneo4j Affected 7.0.0 to before 7.6.4 Fixed in 7.6.4 Patch available CNA

Remediation

Upgrade @neo4j/graphql to version 7.6.4, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA @neo4j/graphql (Neo4j) Fixed in 7.6.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Neo4j @neo4j/graphql 7.6.4

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-71015 Authentication ignored for top-level @cypher fields in @neo4j/graphqlPriority MEDIUM 48
    Show all 2 records →

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-92682
  2. 2026-10-13 Priority changed: MEDIUM → LOW
  3. 2026-10-16 CISA SSVC decision points changed

References

Patch 1

Advisory 1

Other 2

  • TI-2021-13406 Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that… CVSS 3.1CRITICAL 9.8
  • TI-2026-71015 Authentication ignored for top-level @cypher fields in @neo4j/graphql CVSS 4.0CRITICAL 9.3
  • TI-2018-16042 neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External… CVSS 3.0CRITICAL 10.0
  • TI-2018-13005 Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9… CVSS 3.0CRITICAL 9.8
  • TI-2021-18971 A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before… CVSS 3.1CRITICAL 9.1
  • TI-2026-01049 Insufficient escaping of unicode characters in query log CVSS 4.0LOW 1.1
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences