CVE-2026-92684: Aggregation queries can bypass authentication restrictions in @neo4j/graphql

Published Nov 10, 2026

Updated

Missing Authentication for Critical Function in aggregation queries in Neo4j @neo4j/graphql 5.0.0 before 5.12.17 and 7.0.0 before 7.6.8 allows remote attackers to read protected data via GraphQL aggregation queries. Field-level @authentication is not enforced on string aggregates, which can return stored values verbatim, and connection-root aggregates bypass an entity's AGGREGATE authentication requirement, allowing unauthenticated callers to obtain aggregate results.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade @neo4j/graphql to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade @neo4j/graphql to a version that resolves this vulnerability.
Fixed in 5.12.17

Event History

Nov 10, 2026

CVE Published

via MITRE·04:46 PM

Data Sourced

via MITRE·04:46 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using @neo4j/graphql versions 5.0.0 through 5.12.16 or 7.0.0 through 7.6.7 are affected. The issue applies where GraphQL aggregation queries can be reached by remote callers.

What does an attacker need to exploit this issue?

An attacker needs the ability to submit GraphQL aggregation queries. No authentication is required when exploiting the connection-root aggregate bypass described in the advisory.

What data may be exposed?

String aggregate queries can return protected stored values verbatim because field-level @authentication is not enforced. Connection-root aggregates may also return aggregate results despite an entity's AGGREGATE authentication requirement.

How can I determine whether my schema is exposed?

Review schemas that use field-level @authentication on string fields or AGGREGATE authentication requirements on entities, and determine whether corresponding aggregation or connection-root aggregate queries are accessible. Test whether unauthenticated GraphQL requests can obtain string aggregate values or entity aggregate results.

What should be done if patching cannot happen immediately?

Restrict unauthenticated access to GraphQL aggregation queries, especially string aggregates and connection-root aggregate operations. Limit GraphQL endpoint access to trusted callers until an affected version can be updated.

CVE-2026-92684: Aggregation queries can bypass authentication restrictions in @neo4j/graphql

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What data may be exposed?

How can I determine whether my schema is exposed?

What should be done if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What data may be exposed?

How can I determine whether my schema is exposed?

What should be done if patching cannot happen immediately?