CVE-2026-1524 is an authorization bypass vulnerability classified under CWE-863 (Incorrect Authorization) and CWE-287 (Improper Authentication) affecting Neo4j Enterprise Edition's SSO implementation. The flaw manifests when an administrator configures two or more OpenID Connect (OIDC) providers, assigning some as authorization providers and others as authentication-only. In this edge case, the system erroneously grants authorization capabilities to authentication-only providers. This misassignment becomes critical if the authentication-only provider includes groups with privileges exceeding those granted by the designated authorization provider, effectively allowing privilege escalation. The vulnerability stems from improper separation of authentication and authorization logic in the multi-provider SSO setup. Exploitation requires administrative configuration of OIDC providers and high privileges but does not require user interaction. The vulnerability affects versions from 4.4.0 through 2025.01 and was publicly disclosed in March 2026. The vendor has addressed the issue in versions 2026.02 and 5.26.22. The CVSS 4.0 base score is 2.1, reflecting low severity due to the complexity and prerequisites for exploitation.

The primary impact of CVE-2026-1524 is unauthorized privilege escalation within Neo4j Enterprise environments using multi-provider OIDC SSO configurations. Attackers or misconfigured administrators could gain elevated access rights beyond intended authorization boundaries, potentially exposing sensitive graph data or allowing unauthorized modifications. This could undermine data confidentiality and integrity, especially in environments where Neo4j holds critical or sensitive information. However, the impact is limited by the requirement for administrative configuration access and the absence of remote exploitation without prior privileges. Organizations relying on Neo4j for critical infrastructure, data analytics, or enterprise applications could face increased insider threat risks or accidental privilege misassignments leading to data exposure or corruption.

To mitigate this vulnerability, organizations should upgrade Neo4j Enterprise Edition to version 2026.02 or 5.26.22 where the issue is resolved. Until upgrading, administrators must carefully review and avoid configurations that combine multiple OIDC providers with mixed roles (authorization and authentication-only) to prevent unintended privilege grants. Specifically, avoid assigning higher privilege groups to authentication-only providers or ensure that authentication-only providers do not contain groups with elevated privileges. Conduct thorough audits of OIDC provider configurations and group privilege assignments. Implement strict role-based access controls and monitor authentication and authorization logs for anomalies. Additionally, restrict administrative access to Neo4j configuration settings to trusted personnel only. Employ defense-in-depth by isolating Neo4j instances and limiting network access to trusted users and systems.