{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-92683","assignerOrgId":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","state":"PUBLISHED","assignerShortName":"Neo4j","dateReserved":"2026-09-16T16:17:17.929Z","datePublished":"2026-11-09T09:43:18.366Z","dateUpdated":"2026-11-12T16:08:55.061Z"},"containers":{"cna":{"providerMetadata":{"orgId":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","shortName":"Neo4j","dateUpdated":"2026-11-09T09:43:18.366Z"},"title":"Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","type":"CWE"}]}],"impacts":[{"descriptions":[{"lang":"en","value":"Authorization bypass: JWT claim requirements beyond the first condition (such as a required role) are not enforced, allowing access to data or operations protected by @authentication."}]}],"affected":[{"vendor":"Neo4j","product":"@neo4j/graphql","collectionURL":"https://registry.npmjs.org","packageName":"@neo4j/graphql","repo":"https://github.com/neo4j/graphql","versions":[{"status":"affected","version":"7.0.0","lessThan":"7.6.7","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax.","supportingMedia":[{"type":"text/html","base64":false,"value":"Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax."}]}],"references":[{"url":"https://github.com/neo4j/graphql/security/advisories/GHSA-58qp-3mmm-5vh8","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.6,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}],"workarounds":[{"lang":"en","value":"For versions prior to 7.6.7, express multi-condition jwt where filters either with an explicit AND array (for example jwt: { AND: [{ iss: { eq: \"https://idp.example.com\" } }, { roles: { includes: \"admin\" } }] }) or with the inline operator syntax (for example roles_INCLUDES: \"admin\"). Both forms evaluate all conditions.","supportingMedia":[{"type":"text/html","base64":false,"value":"For versions prior to 7.6.7, express multi-condition <tt>jwt</tt> <tt>where</tt> filters either with an explicit <tt>AND</tt> array (for example <tt>jwt: { AND: [{ iss: { eq: \"https://idp.example.com\" } }, { roles: { includes: \"admin\" } }] }</tt>) or with the inline operator syntax (for example <tt>roles_INCLUDES: \"admin\"</tt>). Both forms evaluate all conditions."}]}],"solutions":[{"lang":"en","value":"Upgrade @neo4j/graphql to version 7.6.7 or later.","supportingMedia":[{"type":"text/html","base64":false,"value":"Upgrade <tt>@neo4j/graphql</tt> to version 7.6.7 or later."}]}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-11-12T16:07:46.562442Z","id":"CVE-2026-92683","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-11-12T16:08:55.061Z"}}]}}