Authentication Bypass in Neo4j GraphQL Library Versions 5.2.0
CVE-2026-19869

7.6HIGH

Key Information:

Vendor

Neo4j

Status
Graphql
Vendor
CVE Published:
18 August 2026

What is CVE-2026-19869?

The Neo4j GraphQL Library versions 5.2.0 and later before the patch do not correctly enforce field-level @authentication rules when a type-level @authentication rule is present. This oversight allows clients with coarser permissions to access more restrictive fields without necessary checks, particularly affecting scenarios that require specific admin-role JWT claims. This vulnerability may expose sensitive data and functions, leading to unauthorized access within applications utilizing the affected library.

Affected Version(s)

graphql 7.0.0 < 7.6.0

graphql 5.2.0 < 5.12.15

graphql 6.0.0 <= 6.6.4

References

https://github.com/neo4j/graphql/security/advisories/GHSA...
third-party-advisory
https://neo4j.com/security/CVE-2026-19869
vendor-advisory

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.