CVE-2026-19869: NEO4J Graphql

High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days.

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on Query/Mutation) and a field-level @authentication (on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement — such as an admin-role JWT claim (jwt: { roles_INCLUDES: "admin" }) — is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g. roles: ["user"]) is sufficient.

Affected products

• NEO4J Graphql: from 7.0.0, before 7.6.0 (fixed in 7.6.0); from 5.2.0, before 5.12.15 (fixed in 5.12.15); from 6.0.0, up to and including 6.6.4

Published 2026-08-18. Last modified 2026-09-09.