EUVD-2026-61047Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible GraphQL API requires PR:L (valid user JWT mandatory); AC:L once the vulnerable directive pattern is deployed; no availability impact and no scope change.
Primary rating from Vendor (Neo4j).
CVSS VectorVendor: Neo4j
Lifecycle Timeline
3DescriptionCVE.org
@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on Query/Mutation) and a field-level @authentication (on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement - such as an admin-role JWT claim (jwt: { roles_INCLUDES: "admin" }) - is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g. roles: ["user"]) is sufficient.
AnalysisAI
Authentication bypass in @neo4j/graphql exposes admin-restricted custom-resolver fields to any authenticated user holding a legitimately issued, non-admin JWT. When both a type-level @authentication directive and a stricter field-level @authentication directive are declared on the same Query or Mutation type, the library silently discards the field-level rule and evaluates only the coarser type-level check - meaning a roles: ["user"] token is sufficient to invoke a field that requires roles_INCLUDES: "admin". …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all four of the following conditions to be simultaneously true: (1) the application runs @neo4j/graphql in a version from 5.2.0 to 5.12.14, 6.0.0 to 6.6.4, or 7.0.0 to 7.5.x; (2) the GraphQL schema defines a type-level @authentication directive on a Query or Mutation type AND at least one field-level @authentication directive on a root custom-resolver field within that same type; (3) the field-level directive enforces a stricter requirement than the type-level directive (e.g., an additional JWT role claim); and (4) the attacker possesses a legitimately issued, correctly signed JWT that satisfies the type-level (coarser) requirement. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.6 (High) with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N is a fair representation of actual risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade @neo4j/graphql to a patched version: 5.12.15 or later for 5.x deployments, or 7.6.0 or later for 7.x deployments. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployments of @neo4j/graphql and confirm which affected versions (5.2.0-5.12.14, 6.0.0-6.6.4, 7.0.0-7.5.x) are in use by reviewing package.json and dependency manifests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in
Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects,
Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authenti
APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. Rated high severity (CVSS 8.1), this vulnerability i
Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling di
A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow
JWT authentication bypass in @neo4j/graphql allows unauthenticated remote clients to forge arbitrary JWT claims over Gra
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentic
The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker al
Bolt protocol handshake decoder in Neo4j Enterprise and Community Editions fails to distinguish overlong capability mask
Neo4J versions up to 2026.01 contains a vulnerability that allows attackers to XSS if the user opens the logs in a tool
An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today