Neo4j Graphql
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Neo4j Graphql.
By the Year
In 2026 there have been 2 vulnerabilities in Neo4j Graphql with an average score of 7.9 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 2 | 7.90 |
It may take a day or so for new Graphql vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Neo4j Graphql Security Vulnerabilities
Neo4j GraphQL 5.2.0- Field-level @auth bypass
CVE-2026-19869
7.6 - High
- August 18, 2026
@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on Query/Mutation) and a field-level @authentication (on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement such as an admin-role JWT claim (jwt: { roles_INCLUDES: "admin" }) is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g. roles: ["user"]) is sufficient.
Insecure Direct Object Reference / IDOR
Neo4j GraphQL Library <7.5.6: Unauthorized JWT Forgery in Subscriptions
CVE-2026-5423
8.2 - High
- August 06, 2026
@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JWT claims (e.g. sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for the purposes of @authentication and @subscriptionsAuthorization directive evaluation. This allows a fully unauthenticated attacker to receive subscription events that should be restricted to specific authenticated roles/users. Upgrade the library to versions 7.5.6+ or 5.12.14+. v6 is end-of-life and will not receive a fix.
Authentication Bypass by Assumed-Immutable Data
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Neo4j Graphql or by Neo4j? Click the Watch button to subscribe.
