CVE-2026-19869: Neo4j GraphQL Auth Bypass Vulnerability

CVE-2026-19869 Overview

CVE-2026-19869 is an authorization bypass vulnerability in the @neo4j/graphql library affecting versions from 5.2.0 up to the patched releases. The library fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is present on the same operation type. Only the type-level rule is evaluated, and the stricter field-level rule is silently discarded. Any client holding a valid non-admin JWT that satisfies the coarser type-level rule can invoke fields intended for privileged roles such as admin. The flaw is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Authenticated low-privilege users can invoke root custom-resolver fields protected by admin-role JWT claims, bypassing field-level authorization without any token forgery.

Affected Products

@neo4j/graphql library versions from 5.2.0 up to the patched releases
GraphQL APIs built on @neo4j/graphql that combine type-level and field-level @authentication directives
Applications relying on role-based JWT claims (for example jwt: { roles_INCLUDES: "admin" }) for per-field authorization

Discovery Timeline

2026-08-18 - CVE-2026-19869 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-19869

Vulnerability Analysis

The @neo4j/graphql library supports both type-level and field-level @authentication directives to enforce access control on GraphQL operations. When a schema declares an @authentication directive on the Query or Mutation type and a second @authentication directive on a root custom-resolver field inside that type, the library evaluates only the type-level rule. The field-level rule is dropped during schema construction and never contributes to the authorization check.

The practical result is a broken access control condition. A schema author may require any authenticated user at the type level and additionally require the admin role for a specific resolver such as deleteAllUsers. Under the vulnerable behavior, holders of a legitimately signed non-admin token (for example roles: ["user"]) satisfy the type-level rule and gain access to the admin-only resolver. No token forgery, signature bypass, or key material compromise is required.

Root Cause

The root cause is a directive-merge defect in schema construction. When both directives are declared on the same operation, the library treats the type-level rule as the authoritative policy and discards the field-level rule instead of applying both requirements. This produces an unsafe union rather than the intended intersection of authorization predicates.

Attack Vector

Exploitation is remote over the network and requires only a valid JWT that satisfies the type-level rule. An authenticated non-admin client sends a standard GraphQL request invoking the restricted root custom-resolver field. The server evaluates the type-level rule, passes the check, and executes the resolver as if the admin claim were present. Refer to the GitHub Security Advisory and the Neo4j CVE-2026-19869 advisory for schema patterns known to trigger the flaw.

Detection Methods for CVE-2026-19869

Indicators of Compromise

GraphQL requests from non-admin JWT holders successfully invoking root custom-resolver fields that require an admin role claim
Application logs showing resolver execution for privileged operations without an accompanying admin-claim validation event
Anomalous rates of write, delete, or administrative mutations originating from accounts assigned only the user role

Detection Strategies

Audit deployed GraphQL schemas for co-located type-level and field-level @authentication directives on Query or Mutation, and verify enforcement behavior against the affected library versions.
Correlate GraphQL operation names with the authenticated principal's role claim and alert when the operation requires a role the principal does not hold.
Replay known-restricted operations with a non-admin token in a staging environment to confirm whether the field-level rule is honored.

Monitoring Recommendations

Ingest GraphQL request and resolver-execution logs into a centralized data lake to enable role-versus-operation correlation over time.
Track invocation counts of root custom-resolver fields tagged as admin-only, segmented by JWT sub and roles claims.
Alert on first-time invocations of privileged resolvers by principals whose historical activity is limited to non-admin operations.

How to Mitigate CVE-2026-19869

Immediate Actions Required

Upgrade @neo4j/graphql to the patched version identified in the GitHub Security Advisory.
Enumerate all schemas that combine type-level and field-level @authentication directives and treat those fields as exposed until the upgrade is deployed.
Rotate any credentials or data touched by admin-only resolvers if logs indicate access by non-admin principals.

Patch Information

Neo4j has released fixed versions of @neo4j/graphql that correctly evaluate both type-level and field-level @authentication rules on root custom-resolver fields. Consult the Neo4j CVE-2026-19869 advisory for the exact patched version range applicable to your deployment and follow the vendor upgrade guidance.

Workarounds

Remove the type-level @authentication directive and apply authentication rules directly on each root field so the stricter field-level requirement is evaluated.
Enforce role checks inside custom resolver implementations by validating the JWT roles claim in code before executing privileged logic.
Place an authorization gateway or middleware in front of the GraphQL endpoint to reject requests to admin-only operations from principals lacking the required role.

bash

# Configuration example
# Upgrade @neo4j/graphql to the patched release
npm install @neo4j/graphql@latest
npm ls @neo4j/graphql