CVE-2026-92682

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.

CVSS

No CVSS.

References

Link	Resource
https://github.com/neo4j/graphql/commit/17650cc370445a6bb9d394d34063d3623e987aa2
https://github.com/neo4j/graphql/releases/tag/%40neo4j%2Fgraphql%407.6.4
https://github.com/neo4j/graphql/security/advisories/GHSA-h873-p2wr-fjx6
https://www.npmjs.com/package/@neo4j/graphql

Configurations

No configuration.

History

12 Oct 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-12 16:17

Updated : 2026-10-16 19:55

NVD link : CVE-2026-92682

Mitre link : CVE-2026-92682

CVE.ORG link : CVE-2026-92682

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-92682", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92682", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T17:26:13.854948Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "affectedData": [{"repo": "https://github.com/neo4j/graphql", "vendor": "Neo4j", "product": "@neo4j/graphql", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.6.4", "versionType": "semver"}], "packageName": "@neo4j/graphql", "collectionURL": "https://registry.npmjs.org", "defaultStatus": "unaffected"}]}], "published": "2026-10-12T16:17:07.480", "references": [{"url": "https://github.com/neo4j/graphql/commit/17650cc370445a6bb9d394d34063d3623e987aa2", "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}, {"url": "https://github.com/neo4j/graphql/releases/tag/%40neo4j%2Fgraphql%407.6.4", "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}, {"url": "https://github.com/neo4j/graphql/security/advisories/GHSA-h873-p2wr-fjx6", "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}, {"url": "https://www.npmjs.com/package/@neo4j/graphql", "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as \"none of the related denied users matches the JWT subject\" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4."}], "lastModified": "2026-10-16T19:55:59.740", "sourceIdentifier": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}