Authorization Bypass in Neo4j GraphQL Directive
CVE-2026-92683

8.6HIGH

Key Information:

Vendor

Neo4j

Status
@neo4j/graphql
Vendor
CVE Published:
9 November 2026

What is CVE-2026-92683?

An authorization bypass vulnerability exists in the JWT where filter evaluation of the Neo4j GraphQL integration, versions 7.0.0 through 7.6.7. Attackers can exploit this flaw by using a valid JWT to circumvent all but the initial filter condition in multi-condition filters, potentially exposing sensitive data that should be protected under standard authorization checks.

Affected Version(s)

@neo4j/graphql 7.0.0 < 7.6.7

References

https://github.com/neo4j/graphql/security/advisories/GHSA...
vendor-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.