CVE-2026-19869

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on individual fields are enforced. An application exposing a top-level @cypher field and relying on schema-level or type-level @authentication allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, potentially permitting reading and modifying data. Fixed in 7.6.4.

The @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client can forge arbitrary JWT claims (e.g., sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for @authentication and @subscriptionsAuthorization directive evaluation. This allows an unauthenticated attacker to receive subscription events restricted to specific authenticated roles/users. Upgrade to versions 7.5.6+ or 5.12.14+.