@neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier
Summary
| CVE | CVE-2026-92682 |
|---|---|
| State | PUBLISHED |
| Assigner | Neo4j |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-12 16:17:07 UTC |
| Updated | 2026-10-16 19:55:59 UTC |
| Description | In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4. |
Risk And Classification
Primary CVSS: v4.0 8.6 HIGH from 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.003130000 probability, percentile 0.226580000 (date 2026-10-16)
Problem Types: CWE-863 | CWE-863 CWE-863 Incorrect Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6 | Secondary | 8.6 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.6 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Neo4j | @neo4j/graphql | affected 7.0.0 7.6.4 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/neo4j/graphql/commit/17650cc370445a6bb9d394d34063d3623e987aa2 | 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6 | github.com | |
| github.com/neo4j/graphql/releases/tag/%40neo4j%2Fgraphql%407.6.4 | 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6 | github.com | |
| github.com/neo4j/graphql/security/advisories/GHSA-h873-p2wr-fjx6 | 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6 | github.com | |
| www.npmjs.com/package/@neo4j/graphql | 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6 | www.npmjs.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Neo4j Application Security team (en)
Additional Advisory Data
Solutions
CNA: Upgrade @neo4j/graphql to version 7.6.4 or later.
Workarounds
CNA: Avoid the none quantifier in @authorization relationship and connection filters until you can upgrade, and verify any replacement rule with tests that cover both denied and allowed users.