Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Neo4j | @neo4j/graphql | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade @neo4j/graphql to 7.6.8 (latest) or 5.12.17 (LTS).
Vendor Workaround
Restrict access to aggregate queries over protected data until the upgrade is applied.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 10 Nov 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Missing Authentication for Critical Function in aggregation queries in Neo4j @neo4j/graphql 5.0.0 before 5.12.17 and 7.0.0 before 7.6.8 allows remote attackers to read protected data via GraphQL aggregation queries. Field-level @authentication is not enforced on string aggregates, which can return stored values verbatim, and connection-root aggregates bypass an entity's AGGREGATE authentication requirement, allowing unauthenticated callers to obtain aggregate results. | |
| Title | Aggregation queries can bypass authentication restrictions in @neo4j/graphql | |
| First Time appeared |
Neo4j
Neo4j Neo4j Graphql |
|
| Weaknesses | CWE-306 | |
| CPEs | cpe:2.3:a:neo4j:_neo4j_graphql:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Neo4j
Neo4j Neo4j Graphql |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: Neo4j
Published:
Updated: 2026-11-10T16:46:02.458Z
Reserved: 2026-09-16T16:17:17.929Z
Link: CVE-2026-92684
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-10T17:17:50.150
Modified: 2026-11-10T17:17:50.150
Link: CVE-2026-92684
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-306
Missing Authentication for Critical Function