CVE-2026-92682: CWE-863 Incorrect Authorization in Neo4j @neo4j/graphql
Description
CVE-2026-92682 is an authorization vulnerability in @neo4j/graphql versions 7.0.0 up to but not including 7.6.4. The issue arises because the 'none' quantifier in @authorization filters on relationships and connections is not correctly negated when translated to Cypher queries. This causes rules intended to deny access to actually return the protected records, allowing authenticated users to read, create, or delete sensitive data they should not access. The vulnerability is fixed in version 7.6.4.
CVSS v4.0
Score 8.6high
Affected software
Neo4j
@neo4j/graphql
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In @neo4j/graphql versions >=7.0.0 and <7.6.4, the 'none' quantifier in @authorization filters on relationships and connections is improperly implemented. Instead of negating the condition as intended, it behaves like 'some', causing authorization rules that should exclude certain users to instead include them. This flaw allows authenticated users who should be denied access to read, create, or delete sensitive data. The issue affects both queries and mutations. The vulnerability is addressed and fixed in version 7.6.4.
Potential Impact
Authenticated users who are supposed to be denied access by authorization rules can bypass these restrictions. They can read sensitive records and perform unauthorized mutations such as creating or deleting protected data. This leads to potential data exposure and unauthorized data manipulation, violating access control policies.
Mitigation Recommendations
Upgrade @neo4j/graphql to version 7.6.4 or later, where this authorization issue is fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Neo4j
- Date Reserved
- 2026-09-16T16:17:17.929Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6accfdf32cdf04f656a8855d
Added to database: 10/12/2026, 15:34:11 UTC
Last enriched: 10/12/2026, 15:48:14 UTC
Last updated: 10/12/2026, 15:49:04 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.