Vulnerability · Published Aug 18, 2026 · Assigned by Neo4j
CVE-2026-19869Privilege Escalation via Dropped Field-Level @authentication
High 7.6
In plain English
A high-severity authorization bypass via user-controlled key in graphql from neo4j. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on Query/Mutation) and a field-level @authentication (on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement — such as an admin-role JWT claim (jwt: { roles_INCLUDES: "admin" }) — is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g. roles: ["user"]) is sufficient.
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/neo4j/graphql/security/advisories/GHSA-82m8-p9px-c3x5 third-party-advisory
- https://neo4j.com/security/CVE-2026-19869 vendor-advisory