Authentication Flaw in Neo4j GraphQL Aggregation Queries Exposes Sensitive Data

CVE-2026-92684

What is CVE-2026-92684?

The Neo4j GraphQL library suffers from a significant authentication issue in its handling of aggregation queries. This flaw allows remote attackers to access sensitive information through GraphQL aggregation queries without proper verification. Specifically, the lack of enforced field-level @authentication on string aggregates can lead to the disclosure of stored values. Additionally, connection-root aggregates circumvent the AGGREGATE authentication requirements, enabling unauthenticated users to retrieve aggregate results, ultimately compromising the integrity and confidentiality of sensitive data.

References