CVE-2026-1524

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1524", "assignerOrgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "state": "PUBLISHED", "assignerShortName": "Neo4j", "dateReserved": "2026-01-28T11:20:54.690Z", "datePublished": "2026-03-11T16:16:35.346Z", "dateUpdated": "2026-03-12T16:19:58.434Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "shortName": "Neo4j", "dateUpdated": "2026-03-11T16:16:35.346Z"}, "title": "Auth misconfiguration when multiple providers enabled", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "neo4j", "product": "Enterprise Edition", "versions": [{"status": "affected", "version": "4.4.0", "lessThan": "5.26.22", "versionType": "semver"}, {"status": "affected", "version": "2025.01", "lessThan": "2026.02", "versionType": "date"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:neo4j:enterprise_edition:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.0", "versionEndExcluding": "5.26.22"}, {"vulnerable": true, "criteria": "cpe:2.3:a:neo4j:enterprise_edition:*:*:*:*:*:*:*:*", "versionStartIncluding": "2025.01", "versionEndExcluding": "2026.02"}]}]}], "descriptions": [{"lang": "en", "value": "An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:\n\n\nIf a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if\u00a0the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider. \n\nWhen using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.\u00a0\n\nWe recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:<br></p><p>If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if&nbsp;<span>the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider. </span></p><p><span>When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.&nbsp;</span></p><p><span>We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed. <br></span></p>"}]}], "references": [{"url": "https://neo4j.com/security/CVE-2026-1524", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "GREEN", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Green"}}], "configurations": [{"lang": "en", "value": "Only applicable if multiple OIDC providers (or multiple auth plugins) are configured with separate authentication and authorization intent.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Only applicable if multiple OIDC providers (or multiple auth plugins) are configured with separate authentication and authorization intent."}]}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T15:43:20.625306Z", "id": "CVE-2026-1524", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T16:19:58.434Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1524", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T15:43:20.625306Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T15:43:24.885Z"}}], "cna": {"title": "Auth misconfiguration when multiple providers enabled", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 2.1, "Automatable": "NO", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "neo4j", "product": "Enterprise Edition", "versions": [{"status": "affected", "version": "4.4.0", "lessThan": "5.26.22", "versionType": "semver"}, {"status": "affected", "version": "2025.01", "lessThan": "2026.02", "versionType": "date"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://neo4j.com/security/CVE-2026-1524", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:\n\n\nIf a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if\u00a0the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider. \n\nWhen using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.\u00a0\n\nWe recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.", "supportingMedia": [{"type": "text/html", "value": "<p>An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:<br></p><p>If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if&nbsp;<span>the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider. </span></p><p><span>When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.&nbsp;</span></p><p><span>We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed. <br></span></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "configurations": [{"lang": "en", "value": "Only applicable if multiple OIDC providers (or multiple auth plugins) are configured with separate authentication and authorization intent.", "supportingMedia": [{"type": "text/html", "value": "Only applicable if multiple OIDC providers (or multiple auth plugins) are configured with separate authentication and authorization intent.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:neo4j:enterprise_edition:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.26.22", "versionStartIncluding": "4.4.0"}, {"criteria": "cpe:2.3:a:neo4j:enterprise_edition:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2026.02", "versionStartIncluding": "2025.01"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "shortName": "Neo4j", "dateUpdated": "2026-03-11T16:16:35.346Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1524", "state": "PUBLISHED", "dateUpdated": "2026-03-12T16:19:58.434Z", "dateReserved": "2026-01-28T11:20:54.690Z", "assignerOrgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "datePublished": "2026-03-11T16:16:35.346Z", "assignerShortName": "Neo4j"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Enterprise Edition", "vendor": "neo4j", "versions": [{"lessThan": "5.26.22", "status": "affected", "version": "4.4.0", "versionType": "semver"}, {"lessThan": "2026.02", "status": "affected", "version": "2025.01", "versionType": "date"}]}], "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "2F0CBF4C-6B09-4AF9-9A75-C079D06F8791", "versionEndExcluding": "5.26.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "EA7E7D95-325F-4EC6-A75F-35E2DD1248DF", "versionEndExcluding": "2026.02.0", "versionStartIncluding": "2025.01.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:\n\n\nIf a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if\u00a0the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider. \n\nWhen using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.\u00a0\n\nWe recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed."}, {"lang": "es", "value": "Un caso l\u00edmite en la implementaci\u00f3n de SSO en versiones de Neo4j Enterprise edition anteriores a la versi\u00f3n 2026.02 puede llevar a un acceso no autorizado bajo las siguientes condiciones:\n\nSi un administrador de Neo4j configura dos o m\u00e1s proveedores OIDC Y configura uno o m\u00e1s de ellos como proveedor de autorizaci\u00f3n Y configura uno o m\u00e1s de ellos para ser solo de autenticaci\u00f3n, entonces aquellos que son solo de autenticaci\u00f3n tambi\u00e9n proporcionar\u00e1n autorizaci\u00f3n. Este caso l\u00edmite se convierte en un problema de seguridad solo si el proveedor solo de autenticaci\u00f3n contiene grupos que tienen privilegios m\u00e1s altos que los proporcionados por el proveedor de autorizaci\u00f3n previsto (configurado).\n\nAl usar m\u00faltiples plugins para autenticaci\u00f3n y autorizaci\u00f3n, antes de la correcci\u00f3n, el problema podr\u00eda llevar a que un plugin configurado para proporcionar solo capacidades de autenticaci\u00f3n o autorizaci\u00f3n proporcionara err\u00f3neamente ambas capacidades.\n\nRecomendamos actualizar a las versiones 2026.02 (o 5.26.22) donde el problema est\u00e1 corregido."}], "id": "CVE-2026-1524", "lastModified": "2026-08-28T16:08:38.363", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "GREEN", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Green", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}, "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1524", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T15:43:20.625306Z", "version": "2.0.3"}}]}, "published": "2026-03-11T17:16:54.477", "references": [{"source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "tags": ["Vendor Advisory"], "url": "https://neo4j.com/security/CVE-2026-1524"}], "sourceIdentifier": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-863"}], "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.0,5.26.22)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "calver", "value": "[2025.01,2026.02)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Enterprise Edition", "source": "cna", "vendor": "neo4j"}, "product": "enterprise_edition", "vendor": "neo4j"}], "analysis": {"en": {"generated_at": "2026-03-17T14:55:59.458866+00:00", "value": {"mitigation_remediation": ["Upgrade Neo4j Enterprise Edition to version 2026.02 or later (or to 5.26.22) to apply the vendor fix.", "If an upgrade cannot be performed immediately, review the OIDC provider configuration to ensure that any providers marked as authentication\u2011only do not contain groups with privileges higher than the intended authorization providers, and remove or adjust those groups accordingly.", "Consider temporarily disabling authentication\u2011only OIDC providers until the patch is applied to prevent accidental authorization leakage.", "Refer to the vendor's advisory at https://neo4j.com/security/CVE-2026-1524 for additional guidance and monitoring of future patches."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "Neo4j Enterprise Edition installations that have two or more OIDC providers enabled and are running versions prior to 2026.02 (or 5.26.22). The vulnerability manifests only when one provider is set for authorization and another for authentication\u2011only, and the authentication\u2011only provider contains higher\u2011privilege groups.", "description_and_impact": "An edgecase in the SSO implementation of Neo4j Enterprise Edition allows an administrator to inadvertently grant both authentication and authorization capabilities to an OIDC provider that was intended to provide only authentication. When at least one provider is configured as an authorization provider and at least one as authentication\u2011only, the authentication\u2011only provider may also provide authorization. If that provider contains groups with higher privileges than the configured authorization provider, members of those groups can gain unintended, elevated access. This flaw is linked to CWE\u2011287 (Authentication) and CWE\u2011863 (Authorization Bypass through Authorization Mechanism). The result is a breach of confidentiality and integrity through unauthorized privilege escalation.", "risk_and_exploitability": "The CVSS score is 2.1, indicating low severity, and the EPSS score is less than 1%, reflecting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the presence of misconfigured OIDC providers, meaning it is most likely local or administrative in nature rather than remotely exploitable. While the risk level is low, the impact of privilege escalation warrants attention and prompt remediation."}}}}, "created": "2026-03-12T09:58:01.618640+00:00", "updated": "2026-03-20T15:30:38.383209+00:00", "vendors": ["neo4j", "neo4j$PRODUCT$enterprise_edition"]}