CVE-2026-92682: Neo4j GraphQL Authorization Bypass Vulnerability

CVE-2026-92682 Overview

CVE-2026-92682 is an authorization bypass [CWE-863] in the @neo4j/graphql library. The flaw affects versions from 7.0.0 up to but not including 7.6.4. The none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher. As a result, none behaves identically to some, inverting the intent of every rule that relies on it. Authenticated users targeted by a none rule can read, create, and delete protected records that the schema was designed to exclude from their access. The maintainers fixed the issue in release 7.6.4.

Critical Impact
Authorization rules using the none quantifier are inverted, granting authenticated users read, create, and delete access to records the schema explicitly denies them.

Affected Products

@neo4j/graphql versions 7.0.0 through 7.6.3
GraphQL APIs built on the Neo4j GraphQL Library that use @authorization directives
Applications applying none quantifiers to relationship or connection filters

Discovery Timeline

2026-10-12 - CVE-2026-92682 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-92682

Vulnerability Analysis

The Neo4j GraphQL Library translates @authorization directives into Cypher predicates executed against the graph database. For relationship and connection filters, developers can use quantifiers such as all, some, and none to constrain which related nodes satisfy the rule. The vulnerable translator emits the same Cypher construct for some and none, omitting the required logical negation. A policy stating "none of the related denied users matches the JWT subject" therefore returns the records it should have excluded. The defect propagates to mutations, so unauthorized users can also create and delete records that the type definitions intended to protect.

Root Cause

In AuthRelationshipFilter.ts and AuthConnectionFilter.ts, the SOME case builds an Exists predicate but never checks whether the operator is actually NONE. Because NONE falls through the same code path, the generated Cypher evaluates existence rather than non-existence, inverting the authorization semantics for every rule that uses it.

Attack Vector

Exploitation requires an authenticated session with a valid JWT. The attacker issues ordinary GraphQL queries or mutations against entities protected by a none authorization rule. Because the translated Cypher returns the opposite result set, the server returns or modifies records the attacker was explicitly denied. No special tooling is required; standard GraphQL clients suffice.

typescript

// Patch in AuthConnectionFilter.ts - adds the missing negation for NONE
                 const match = new Cypher.Match(pattern).where(innerPredicate);
-                return new Cypher.Exists(match);
+                const existsClause = new Cypher.Exists(match);
+                if (this.operator === "NONE") {
+                    return Cypher.not(existsClause);
+                }
+
+                return existsClause;

typescript

// Patch in AuthRelationshipFilter.ts - mirrors the fix for relationship filters
             case "SOME": {
                 const matchClause = new Cypher.Match(pattern).where(innerPredicate);
                 const existsPredicate = new Cypher.Exists(matchClause);
+                if (this.operator === "NONE") {
+                    return Cypher.not(existsPredicate);
+                }
                 return existsPredicate;
             }

Source: GitHub commit 17650cc

Detection Methods for CVE-2026-92682

Indicators of Compromise

Successful GraphQL queries returning records that match the exclusion criteria of a none authorization rule.
Mutation operations (create, update, delete) completed by JWT subjects that appear in deny lists for the target records.
Unexpected modifications or reads against nodes governed by @authorization directives containing the none quantifier.

Detection Strategies

Audit the application schema (typeDefs) for every @authorization directive that uses the none quantifier and treat affected types as high-risk until patched.
Replay representative queries and mutations with denied JWT subjects against a staging instance to confirm whether responses match the vulnerable, inverted behavior.
Enable Cypher query logging on the Neo4j server and inspect translated predicates for EXISTS clauses that lack a surrounding NOT on authorization-protected paths.

Monitoring Recommendations

Correlate GraphQL access logs with JWT sub claims to identify subjects reading or mutating records their authorization rules should block.
Alert on anomalous read volumes or mutation counts against entities protected by relationship-based authorization filters.
Track the installed version of @neo4j/graphql across build pipelines and runtime containers to confirm upgrades reach every environment.

How to Mitigate CVE-2026-92682

Immediate Actions Required

Upgrade @neo4j/graphql to version 7.6.4 or later in every service and container image.
Inventory all @authorization rules using the none quantifier and review the data they govern for unauthorized access during the exposure window.
Rotate any credentials, tokens, or secrets that could have been exposed by the inverted authorization logic.

Patch Information

The fix is included in @neo4j/graphql@7.6.4. The patch adds an explicit Cypher.not() wrapper when the filter operator is NONE in both AuthRelationshipFilter.ts and AuthConnectionFilter.ts. Refer to the GitHub Security Advisory GHSA-h873-p2wr-fjx6 and the GitHub Release 7.6.4 notes for complete details.

Workarounds

Rewrite none quantifier rules to equivalent NOT ... some or all ... != subject expressions until the upgrade is applied.
Enforce authorization at an upstream layer, such as a GraphQL gateway or resolver middleware, that independently validates JWT claims against deny lists.
Restrict mutation operations on affected types to privileged service accounts until the library is patched.

bash

# Upgrade the vulnerable package to the fixed release
npm install @neo4j/graphql@7.6.4

# Verify the installed version
npm ls @neo4j/graphql