The neo4j/graphql library versions 5.2.0 to before 5.12.15, 6.0.0 to 6.6.4, and 7.0.0 to before 7.6.0 contain an authorization bypass (CWE-639) due to improper enforcement of field-level @authentication rules when a type-level @authentication rule is also present on the same operation type (Query or Mutation). In such cases, only the type-level authentication is evaluated, and the field-level authentication is silently ignored. This means stricter per-field access controls, such as requiring an admin role claim in JWT tokens, are not enforced, allowing users with tokens that satisfy only the type-level rule to access more restricted fields. The vulnerability does not involve token forgery but exploits the logic flaw in access control evaluation.

An attacker with a legitimately issued JWT token that satisfies the broader type-level authentication (e.g., roles: ["user"]) can access root custom-resolver fields that require stricter field-level authentication (e.g., admin role). This bypasses intended authorization controls, potentially exposing sensitive data or operations restricted to higher privilege roles. The vulnerability affects confidentiality and integrity of access control within affected neo4j/graphql versions.

No explicit patch links or vendor advisory content are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, users should review their use of combined type-level and field-level @authentication rules and avoid relying solely on field-level restrictions when type-level rules are present. Consider applying additional access control checks outside of the library or restricting access at other layers as a temporary mitigation.