CVE-2026-92682

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92682", "assignerOrgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "state": "PUBLISHED", "assignerShortName": "Neo4j", "dateReserved": "2026-09-16T16:17:17.929Z", "datePublished": "2026-10-12T15:07:44.638Z", "dateUpdated": "2026-10-16T17:27:47.458Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "shortName": "Neo4j", "dateUpdated": "2026-10-12T15:07:44.638Z"}, "title": "@neo4j/graphql: authorization relationship and connection filters invert the \"none\" quantifier", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "type": "CWE"}]}], "affected": [{"vendor": "Neo4j", "product": "@neo4j/graphql", "collectionURL": "https://registry.npmjs.org", "packageName": "@neo4j/graphql", "repo": "https://github.com/neo4j/graphql", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.6.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as \"none of the related denied users matches the JWT subject\" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the <code>none</code> quantifier in <code>@authorization</code> filters on relationships and connections is not negated when translated to Cypher, so it behaves like <code>some</code>. A rule such as \"none of the related denied users matches the JWT subject\" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4."}]}], "references": [{"url": "https://github.com/neo4j/graphql/security/advisories/GHSA-h873-p2wr-fjx6", "name": "GHSA-h873-p2wr-fjx6", "tags": ["vendor-advisory"]}, {"url": "https://github.com/neo4j/graphql/commit/17650cc370445a6bb9d394d34063d3623e987aa2", "name": "Fix commit 17650cc", "tags": ["patch"]}, {"url": "https://github.com/neo4j/graphql/releases/tag/%40neo4j%2Fgraphql%407.6.4", "name": "@neo4j/graphql 7.6.4 release notes", "tags": ["release-notes"]}, {"url": "https://www.npmjs.com/package/@neo4j/graphql", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "workarounds": [{"lang": "en", "value": "Avoid the none quantifier in @authorization relationship and connection filters until you can upgrade, and verify any replacement rule with tests that cover both denied and allowed users.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Avoid the none quantifier in @authorization relationship and connection filters until you can upgrade, and verify any replacement rule with tests that cover both denied and allowed users.</p>"}]}], "solutions": [{"lang": "en", "value": "Upgrade @neo4j/graphql to version 7.6.4 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade @neo4j/graphql to version 7.6.4 or later.</p>"}]}], "credits": [{"lang": "en", "value": "Neo4j Application Security team", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-16T17:26:13.854948Z", "id": "CVE-2026-92682", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T17:27:47.458Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92682", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T17:26:13.854948Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T17:27:03.095Z"}}], "cna": {"title": "@neo4j/graphql: authorization relationship and connection filters invert the \"none\" quantifier", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Neo4j Application Security team"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/neo4j/graphql", "vendor": "Neo4j", "product": "@neo4j/graphql", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.6.4", "versionType": "semver"}], "packageName": "@neo4j/graphql", "collectionURL": "https://registry.npmjs.org", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade @neo4j/graphql to version 7.6.4 or later.", "supportingMedia": [{"type": "text/html", "value": "<p>Upgrade @neo4j/graphql to version 7.6.4 or later.</p>", "base64": false}]}], "references": [{"url": "https://github.com/neo4j/graphql/security/advisories/GHSA-h873-p2wr-fjx6", "name": "GHSA-h873-p2wr-fjx6", "tags": ["vendor-advisory"]}, {"url": "https://github.com/neo4j/graphql/commit/17650cc370445a6bb9d394d34063d3623e987aa2", "name": "Fix commit 17650cc", "tags": ["patch"]}, {"url": "https://github.com/neo4j/graphql/releases/tag/%40neo4j%2Fgraphql%407.6.4", "name": "@neo4j/graphql 7.6.4 release notes", "tags": ["release-notes"]}, {"url": "https://www.npmjs.com/package/@neo4j/graphql", "tags": ["product"]}], "workarounds": [{"lang": "en", "value": "Avoid the none quantifier in @authorization relationship and connection filters until you can upgrade, and verify any replacement rule with tests that cover both denied and allowed users.", "supportingMedia": [{"type": "text/html", "value": "<p>Avoid the none quantifier in @authorization relationship and connection filters until you can upgrade, and verify any replacement rule with tests that cover both denied and allowed users.</p>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as \"none of the related denied users matches the JWT subject\" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.", "supportingMedia": [{"type": "text/html", "value": "In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the <code>none</code> quantifier in <code>@authorization</code> filters on relationships and connections is not negated when translated to Cypher, so it behaves like <code>some</code>. A rule such as \"none of the related denied users matches the JWT subject\" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "shortName": "Neo4j", "dateUpdated": "2026-10-12T15:07:44.638Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92682", "state": "PUBLISHED", "dateUpdated": "2026-10-16T17:27:47.458Z", "dateReserved": "2026-09-16T16:17:17.929Z", "assignerOrgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "datePublished": "2026-10-12T15:07:44.638Z", "assignerShortName": "Neo4j"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://registry.npmjs.org", "defaultStatus": "unaffected", "packageName": "@neo4j/graphql", "product": "@neo4j/graphql", "repo": "https://github.com/neo4j/graphql", "vendor": "Neo4j", "versions": [{"lessThan": "7.6.4", "status": "affected", "version": "7.0.0", "versionType": "semver"}]}], "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as \"none of the related denied users matches the JWT subject\" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4."}], "id": "CVE-2026-92682", "lastModified": "2026-10-16T19:55:59.740", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92682", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T17:26:13.854948Z", "version": "2.0.3"}}]}, "published": "2026-10-12T16:17:07.480", "references": [{"source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "url": "https://github.com/neo4j/graphql/commit/17650cc370445a6bb9d394d34063d3623e987aa2"}, {"source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "url": "https://github.com/neo4j/graphql/releases/tag/%40neo4j%2Fgraphql%407.6.4"}, {"source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "url": "https://github.com/neo4j/graphql/security/advisories/GHSA-h873-p2wr-fjx6"}, {"source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "url": "https://www.npmjs.com/package/@neo4j/graphql"}], "sourceIdentifier": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.6.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "@neo4j/graphql", "source": "cna", "vendor": "Neo4j"}, "product": "graphql", "vendor": "neo4j"}], "created": "2026-10-12T17:15:15.274878+00:00", "updated": "2026-10-13T07:26:53.424102+00:00", "vendors": ["neo4j", "neo4j$PRODUCT$graphql"]}