CVE-2026-19869: Privilege Escalation via Dropped Field-Level @authentication

Severity: high (CVSS 7.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-18 · updated 2026-10-22
Weakness: CWE-639

Description

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on Query/Mutation) and a field-level @authentication (on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement — such as an admin-role JWT claim (jwt: { roles_INCLUDES: "admin" }) — is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g. roles: ["user"]) is sufficient.

Affected products

neo4j graphql: from 7.0.0 before 7.6.0; from 5.2.0 before 5.12.15; from 6.0.0 through 6.6.4 — fixed in 5.12.15, 7.6.0

How to fix

Upgrade to a fixed version: neo4j graphql 5.12.15, 7.6.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-19869 or the next vulnerability affects your stack