What’s Vulnerable › Vulnerabilities

CVE-2026-92682: @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier

• Severity: high (CVSS 8.6 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-16
• Weakness: CWE-863

Description

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.

Affected products

• Neo4j @neo4j/graphql: from 7.0.0 before 7.6.4 — fixed in 7.6.4

How to fix

Upgrade to a fixed version: Neo4j @neo4j/graphql 7.6.4. Check the vendor advisory for mitigations.

References

• https://github.com/neo4j/graphql/commit/17650cc370445a6bb9d394d34063d3623e987aa2
• https://github.com/neo4j/graphql/releases/tag/%40neo4j%2Fgraphql%407.6.4
• https://github.com/neo4j/graphql/security/advisories/GHSA-h873-p2wr-fjx6
• https://www.npmjs.com/package/@neo4j/graphql

Get alerted when CVE-2026-92682 or the next vulnerability affects your stack