Skip to content
OpenAdvisories

Product · neo4j

graphql

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.6
    CVE-2026-19869

    Privilege Escalation via Dropped Field-Level @authentication

    @neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (o…

    neo4j graphql
  • High 8.2
    CVE-2026-5423

    Subscription Authentication Bypass via Unverified connectionParams.jwt

    @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSo…

    neo4j graphql