CVE-2026-92682

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92682
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92682.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92682
Aliases
  • GHSA-h873-p2wr-fjx6
Published
2026-10-12T15:07:44Z
Modified
2026-10-13T02:46:55Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
@neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier
Details

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.

Database specific 
{
    "cna_assigner":  "Neo4j",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92682.json"
}
References

Affected packages

Git / github.com/neo4j/graphql

Affected ranges

Type
GIT
Repo
https://github.com/neo4j/graphql
Events
Introduced
16bb032f8a6ffa1d3348a228c6f2b89eeefdb4a5
Fixed
851cb27ed12447e3c19c314a7f695aa0f970110e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "7.0.0"
        },
        {
            "fixed":  "7.6.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

@neo4j/graphql@7.*
@neo4j/graphql@7.0.0
@neo4j/graphql@7.1.0
@neo4j/graphql@7.1.1
@neo4j/graphql@7.1.2
@neo4j/graphql@7.1.3
@neo4j/graphql@7.2.0
@neo4j/graphql@7.2.1
@neo4j/graphql@7.2.10
@neo4j/graphql@7.2.11
@neo4j/graphql@7.2.12
@neo4j/graphql@7.2.13
@neo4j/graphql@7.2.2
@neo4j/graphql@7.2.3
@neo4j/graphql@7.2.4
@neo4j/graphql@7.2.5
@neo4j/graphql@7.2.6
@neo4j/graphql@7.2.7
@neo4j/graphql@7.2.8
@neo4j/graphql@7.2.9
@neo4j/graphql@7.3.0
@neo4j/graphql@7.3.1
@neo4j/graphql@7.3.2
@neo4j/graphql@7.3.3
@neo4j/graphql@7.4.0
@neo4j/graphql@7.4.1
@neo4j/graphql@7.4.2
@neo4j/graphql@7.4.3
@neo4j/graphql@7.4.4
@neo4j/graphql@7.5.0
@neo4j/graphql@7.5.1
@neo4j/graphql@7.5.2
@neo4j/graphql@7.5.3
@neo4j/graphql@7.5.4
@neo4j/graphql@7.5.6
@neo4j/graphql@7.6.0
@neo4j/graphql@7.6.1
@neo4j/graphql@7.6.2
@neo4j/graphql@7.6.3
@neo4j/introspector@5.*
@neo4j/introspector@5.0.0
@neo4j/introspector@5.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92682.json"