All vulnerabilities
CVE-2026-92681GHSA-8xj4-8gg9-fx9h

@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields

Neo4j @neo4j/graphqlDatabases
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7.6.4Fixed versionCVE List
Published12 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

  • 7.6.4@neo4j/graphqlCVE List
  • 7.6.4@neo4j/graphql, npmGitHubnpm install @neo4j/graphql@7.6.4

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. An application that exposes a top-level @cypher field and relies on schema-level or type-level @authentication to protect it allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, which may permit reading and modifying data. Fixed in 7.6.4.

Text from CVE List

Affected versions 2

  • @neo4j/graphqlaffected: 3.23.0 before 7.6.4CVE List
  • @neo4j/graphql, npm<= 7.6.3GitHub

References 4