Neo4j @neo4j/graphql: Missing authentication enforcement on top-level @cypher fields
Summary
Schema-level and type-level @authentication directives are silently ignored for top-level fields annotated with @cypher in @neo4j/graphql up to and including 7.6.3. Only directives placed directly on the individual fields are enforced. An unauthenticated attacker can invoke such a field over the network and run the configured Cypher statement with the privileges of the GraphQL service account, which may allow reading and modifying data. The issue applies only if the application relies on schema- or type-level authentication for these fields.
Affected
- @neo4j/graphql 3.23.0 up to but not including 7.6.4 (CNA range; versions below 3.23.0 not verified, treat as affected until confirmed)
- Only applications exposing top-level @cypher fields that rely on schema-level or type-level @authentication
Fixed in
- Upgrade @neo4j/graphql to version 7.6.4 or later (fix commit ef69cc6)
Workaround
- Apply @authentication directly to each top-level @cypher field (third-party suggestion, not from the vendor; verify in a test environment first)
- Run the GraphQL service account with least-privilege database permissions
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total
- Not listed in CISA KEV; no known exploitation at the time of research
- No public proof-of-concept found; not fully verified
- The fix was developed in public, so the flaw may have been visible in the source history before the advisory
Our recommendation
- Identify all projects using @neo4j/graphql below version 7.6.4 and upgrade to 7.6.4 or later
- Upgrade also covers CVE-2026-92682 (inverted "none" quantifier in authorization filters), which affects 7.0.0 up to 7.6.4
- Until the upgrade is done, check whether the GraphQL endpoint is reachable from the internet and review the service account's database privileges
- After the upgrade, test that schema- and type-level @authentication applies to top-level @cypher fields
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8xj4-8gg9-fx9h github.com
- Fix commit ef69cc6 github.com
- Release @neo4j/graphql 7.6.4 github.com
- OSV CVE-2026-92681 osv.dev
- OSV CVE-2026-92682 osv.dev
- Neo4j GraphQL authentication documentation neo4j.com
- npm package @neo4j/graphql www.npmjs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:31.
Original description (NVD)
In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. An application that exposes a top-level @cypher field and relies on schema-level or type-level @authentication to protect it allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, which may permit reading and modifying data. Fixed in 7.6.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.