Critical 9.3Published Oct 12, 2026

CVE-2026-92681@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields

Updated under an hour ago (2026-10-19 05:50 UTC)

Does this affect you?

It affects Neo4j @neo4j/graphql. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.37%, higher than 29% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Neo4j @neo4j/graphql

Exploited in the last 30 days

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. An application that exposes a top-level @cypher field and relies on schema-level or type-level @authentication to protect it allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, which may permit reading and modifying data. Fixed in 7.6.4.

CVSS: 9.3 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-306
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.37% (percentile 29)
Assigned by: Neo4j
NVD analysis: Awaiting Analysis
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 12, 2026

Affected products

Affected products

Neo4j @neo4j/graphql neo4j:graphql (from the name)	from 3.23.0 before 7.6.4	CNA record

References

https://github.com/neo4j/graphql/security/advisories/GHSA-8xj4-8gg9-fx9hvendor-advisory
https://github.com/neo4j/graphql/commit/ef69cc69ff5e97c60d64aa524005f939c5ba3633patch
https://github.com/neo4j/graphql/releases/tag/%40neo4j%2Fgraphql%407.6.4release-notes
https://www.npmjs.com/package/@neo4j/graphqlproduct

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.