11 matches found
CVE-2026-19869
@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...
CVE-2026-19869 Privilege Escalation via Dropped Field-Level @authentication
@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...
CVE-2026-19869
In @neo4j/graphql 5.2.0+, when both type-level and field-level @authentication directives coexist on a root custom-resolver field, only the type-level rule is evaluated and the stricter field-level rule (e.g., admin-role JWT claim) is silently discarded, allowing any authenticated non-admin clien...
CVE-2026-19869 Privilege Escalation via Dropped Field-Level @authentication
@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...
CVE-2026-19869
@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...
EUVD-2026-61047
@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...
PT-2026-77202
@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...
@cmmv/ai (0.0.5), @graphql-mesh/neo4j (>=0.103.0, <=0.106.2) +2 more potentially affected by CVE-2026-5423 via @neo4j/graphql (6.6.4)
@neo4j/graphql NPM version 6.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on @neo4j/graphql and may be impacted: - @cmmv/ai 0.0.5 - @graphql-mesh/neo4j =0.103.0, =0.7.13-alpha-20241031110808-e6f493d3529c46de0c7c0358ed1e2b5942f2a2a2, =0.7.0, =0.10.2...
CVE-2026-5423 Subscription Authentication Bypass via Unverified connectionParams.jwt
@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...
CVE-2026-5423
@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...
EUVD-2026-54094
@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...