CVE-2026-92682: @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier
In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@neo4j/graphqlto a version that resolves this vulnerability.Fixed in 7.6.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using @neo4j/graphql versions 7.0.0 through 7.6.3 are affected if their authorization typedefs use the none quantifier in relationship or connection filters. Version 7.6.4 fixes the issue.
What does an attacker need to exploit this?
An attacker needs to be an authenticated user subject to an authorization rule that relies on a none relationship or connection filter. No user interaction is required.
What access could an affected user obtain?
The user may be able to read records that the authorization rule was intended to deny. Where the affected rule applies to mutations, they may also create or delete sensitive data despite the typedef-defined restriction.
How can I identify affected authorization rules?
Review @authorization filters on relationships and connections for use of the none quantifier, especially rules intended to deny access when a related denied user matches the JWT subject. In affected versions, those filters behave as some rather than none.
What should be done if upgrading cannot happen immediately?
The provided information identifies 7.6.4 as the fixed version. Until an upgrade is applied, review and avoid relying on affected none-based relationship and connection authorization filters for read or mutation protection.