CVE-2026-92684
Aggregation queries can bypass authentication restrictions in @neo4j/graphql
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Missing Authentication for Critical Function in aggregation queries in Neo4j @neo4j/graphql 5.0.0 before 5.12.17 and 7.0.0 before 7.6.8 allows remote attackers to read protected data via GraphQL aggregation queries. Field-level @authentication is not enforced on string aggregates, which can return stored values verbatim, and connection-root aggregates bypass an entity's AGGREGATE authentication requirement, allowing unauthenticated callers to obtain aggregate results.
| CWE | CWE-306 |
| Vendor | neo4j |
| Product | @neo4j/graphql |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for neo4j @neo4j/graphql
Be the first to know when new unknown vulnerabilities affecting neo4j @neo4j/graphql are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Neo4j / @neo4j/graphql
5.0.0 < 5.12.17 7.0.0 < 7.6.8