CVE-2026-92681 Neo4j CVE debrief

Who should care

GraphQL service administrators and developers using @neo4j/graphql should assess exposure and apply the patch to prevent unauthorized access. They should also review and update GraphQL service configurations to ensure proper authentication and monitor for unauthorized access to top-level @cypher fields. Additionally, they should perform a thorough review of the GraphQL service configurations to ensure that all top-level @cypher fields are properly and to

Why it matters

CVE-2026-92681 allows unauthenticated access to top-level @cypher fields in @neo4j/graphql, potentially leading to data breaches or tampering

• Unauthenticated access to sensitive data
• Potential for data tampering or modification
• Increased risk of data breaches
• Need for verification of patch application

Technical summary

The @neo4j/graphql library has a vulnerability where @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. This allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, potentially leading to data breaches or tampering. The vulnerability affects @neo4j/graphql versions up to 7.6.3 and is fixed in version 7.6.4. To mitigate the vulnerability, administrators should verify and apply the patch, review GraphQL service configurations, and monitor for unauthorized access.

Defensive priority

GraphQL service administrators should verify and apply the patch to prevent unauthorized access

Recommended defensive actions

• Verify the version of @neo4j/graphql and apply the patch to version 7.6.4 or later
• Review and update GraphQL service configurations to ensure proper authentication
• Monitor for unauthorized access to top-level @cypher fields
• Perform a thorough review of the GraphQL service configurations to ensure that all top-level @cypher fields are properly authenticated
• Implement additional monitoring and logging to detect potential unauthorized access
• Conduct regular security audits to identify and address potential vulnerabilities
• Develop an incident response plan in case of a security breach

Evidence notes

The CVE record and source item provide details on the vulnerability in @neo4j/graphql versions up to 7.6.3. The vulnerability allows unauthenticated access to top-level @cypher fields, potentially leading to data breaches or tampering. The @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. The patch is applied in version 7.6.4. Evidence limits are based on CVE and source item details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.