Neo4j @neo4j/graphql: Incorrect authorization due to inverted none quantifier
Summary
In @neo4j/graphql from 7.0.0 before 7.6.4, the none quantifier in @authorization relationship and connection filters is not negated in the generated Cypher query, so it behaves like some. An authenticated low-privilege user whom a rule is meant to deny can read protected records and, according to the vendor-linked description, also create and delete records they should not access. The issue applies only to applications that use this library with such none-based rules.
Affected
- @neo4j/graphql from 7.0.0 up to but not including 7.6.4
Fixed in
- Upgrade @neo4j/graphql to version 7.6.4 or later
Workaround
- Avoid the none quantifier in @authorization relationship and connection filters until the upgrade is done.
- Verify any replacement rule with tests that cover both denied and allowed users.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No evidence of exploitation in the wild found in the sources reviewed.
- Public proof of concept: unknown.
Our recommendation
- Identify custom applications that use @neo4j/graphql and check their versions.
- Upgrade affected installations to 7.6.4 or later; this also covers CVE-2026-92681.
- Review @authorization rules that use none on relationships or connections and test them with denied and allowed users.
- Review access logs for unexpected reads or writes on the affected types.
- Limit account creation and verify that users are denied where intended.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-h873-p2wr-fjx6 github.com
- Fix commit 17650cc github.com
- Release @neo4j/graphql 7.6.4 github.com
- OSV CVE-2026-92682 osv.dev
- npm package @neo4j/graphql www.npmjs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:46.
Original description (NVD)
In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.