CVE-2026-19869 PUBLISHED

Privilege Escalation via Dropped Field-Level @authentication

Assigner: Neo4j
Reserved: 14.08.2026 Published: 18.08.2026 Updated: 18.08.2026

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on Query/Mutation) and a field-level @authentication (on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement — such as an admin-role JWT claim (jwt: { roles_INCLUDES: "admin" }) — is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g. roles: ["user"]) is sufficient.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 7.6

Product Status

Vendor neo4j
Product graphql
Versions Default: unaffected
  • affected from 7.0.0 to 7.6.0 (excl.)
  • affected from 5.2.0 to 5.12.15 (excl.)
  • affected from 6.0.0 to 6.6.4 (incl.)

Affected Configurations

The application enables features.authorization and defines a root operation type (Query/Mutation) annotated with @authentication that also contains one or more custom-resolver fields carrying their own, stricter @authentication rule.

Solutions

Upgrade the library to 7.5.7+ or 5.12.15+. v6 is end-of-life and will not receive a fix. v5 releases prior to 5.2.0 are not affected.

For users who cannot upgrade immediately: do not combine a type-level @authentication with a field-level @authentication on the same root operation type. Because the type-level annotation is what shadows the field-level rule, removing it restores correct enforcement — instead apply a complete @authentication directive to each root field individually, including the full stricter rule on the sensitive field. Alternatively, enforce the stricter requirement inside the custom resolver's own code.

References

Problem Types

  • CWE-639 Authorization bypass through User-Controlled key CWE

Impacts

  • CAPEC-233 Privilege Escalation