CVE-2026-19869
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
@neo4j/graphql from version 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present. The field-level rule is silently discarded, allowing any client satisfying the coarser type-level requirement to invoke the more-restricted field.
Risk Assessment
An attacker with a non-admin token (e.g., role 'user') can access functions requiring higher privileges, potentially leading to unauthorized operations and data security breaches.
Recommendation
Update @neo4j/graphql to a patched version that enforces field-level rules.
Original NVD description (English source)
@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on Query/Mutation) and a field-level @authentication (on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement — such as an admin-role JWT claim (jwt: { roles_INCLUDES: "admin" }) — is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g. roles: ["user"]) is sufficient.