CVE-2026-1497

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-1497
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1497.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-1497
Aliases
Downstream
Published
2026-03-11T15:50:57.651Z
Modified
2026-07-08T08:12:22.606141400Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Green CVSS Calculator
Summary
Incorrect privilege assignment in composite databases
Details

Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario:  an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database or alias doesn't exist when the command is run, the privileges will apply if it's created in the future.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "5.0"
                },
                {
                    "fixed": "5.26.22"
                },
                {
                    "introduced": "2025.01"
                },
                {
                    "fixed": "2026.02"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "introduced": "5.0"
                },
                {
                    "fixed": "5.26.22"
                },
                {
                    "introduced": "2025.01"
                },
                {
                    "fixed": "2026.02"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1497.json",
    "cna_assigner": "Neo4j",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/neo4j/neo4j

Affected ranges

Type
GIT
Repo
https://github.com/neo4j/neo4j
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b6b4c8fbd8e953c19daf4be1ad1136635465f046
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.26.22"
        }
    ]
}

Affected versions

1.*
1.0.0
1.9
1.9.M02
2.*
2.0.1
2.2.0-M01
2.2.0-M03
2.2.0-RC01
2.3.0-M01
2.3.0-M02
3.*
3.0.0-M01
3.0.0-M02
3.0.0-M03
3.0.0-M04
3.0.0-M05
3.1.0-BETA1
3.1.0-M01
3.1.0-M02
3.1.0-M03
3.1.0-M04
3.1.0-M05
3.1.0-M06
3.1.0-M07
3.1.0-M08
3.1.0-M09
3.1.0-M10
3.1.0-M12-beta2
3.1.0-M13-beta3
3.2.0-alpha01
3.2.0-alpha02
3.2.0-alpha03
3.2.0-alpha04
3.2.0-alpha05
3.2.0-alpha06
3.2.0-alpha07
3.2.0-alpha08
3.2.0-rc1
3.3.0-alpha01
3.3.0-alpha02
3.3.0-alpha03
3.3.0-alpha04
3.3.0-alpha05
3.3.0-alpha06
3.3.0-alpha07
3.3.0-beta01
3.4.0-alpha01
3.4.0-alpha02
3.4.0-alpha03
3.4.0-alpha04
3.4.0-alpha05
3.4.0-alpha06
3.4.0-alpha07
3.4.0-alpha08
3.4.0-alpha09
3.4.0-alpha10
3.4.0-beta01
3.4.0-beta02
3.4.0-rc01
4.*
4.0.0-alpha01
4.0.0-alpha02
4.0.0-alpha03
4.0.0-alpha04
4.0.0-alpha05
4.0.0-alpha06
4.0.0-alpha07mr01
4.0.0-alpha08
4.0.0-alpha09mr02
4.0.0-alpha10
4.0.0-beta01
4.0.0-beta02
4.0.0-beta03mr03
4.1.0-alpha01
4.4.0-alpha01
5.*
5.0.0
5.1.0
5.2.0
5.26.14
5.26.18
5.26.20
5.26.21

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1497.json"