{"id":"CVE-2026-92684","aliases":[],"cve":{"records":[{"id":"CVE-2026-92684","source":"Neo4j","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-16T16:17:17.929Z","published":"2026-11-10T16:46:02.458Z","modified":"2026-11-10T16:46:02.458Z"}],"publishers":[{"name":"Neo4j","role":"CNA","organizationId":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","modified":"2026-11-10T16:46:02.458Z"}],"references":[{"url":"https://github.com/neo4j/graphql/security/advisories/GHSA-9r8x-hf5g-rh66","tags":["vendor-advisory"],"source":"Neo4j"}],"weaknesses":[{"id":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","source":"Neo4j"}],"applicability":[{"source":"Neo4j","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:neo4j:_neo4j_graphql:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.12.17"},{"vulnerable":true,"criteria":"cpe:2.3:a:neo4j:_neo4j_graphql:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.6.8"}]}]}]}],"prioritization":[]},"title":"Aggregation queries can bypass authentication restrictions in @neo4j/graphql","titleSource":"Neo4j","descriptionSource":"Neo4j","description":"Missing Authentication for Critical Function in aggregation queries in Neo4j @neo4j/graphql 5.0.0 before 5.12.17 and 7.0.0 before 7.6.8 allows remote attackers to read protected data via GraphQL aggregation queries. Field-level @authentication is not enforced on string aggregates, which can return stored values verbatim, and connection-root aggregates bypass an entity's AGGREGATE authentication requirement, allowing unauthenticated callers to obtain aggregate results.","score":8.7,"severity":"high","published":"2026-11-10T16:46:02.458Z","modified":"2026-11-10T16:46:02.458Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Neo4j","name":"@neo4j/graphql","platforms":[],"versions":[{"version":"5.0.0","status":"affected","lessThan":"5.12.17","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThan":"7.6.8","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Neo4j","url":"https://www.cve.org/CVERecord?id=CVE-2026-92684"}],"remediation":[{"text":"Upgrade @neo4j/graphql to 7.6.8 (latest) or 5.12.17 (LTS).","source":"Neo4j","url":"https://www.cve.org/CVERecord?id=CVE-2026-92684"},{"text":"Restrict access to aggregate queries over protected data until the upgrade is applied.","source":"Neo4j","url":"https://www.cve.org/CVERecord?id=CVE-2026-92684"}],"references":["https://github.com/neo4j/graphql/security/advisories/GHSA-9r8x-hf5g-rh66"],"sources":[{"name":"CVE","id":"CVE-2026-92684","modified":"2026-11-10T16:46:02.458Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-92684"}],"assessments":[{"source":"Neo4j","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7}],"sourceAffected":[],"observedAt":"2026-11-10T16:51:16.784Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:30:30.969Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T16:55:32.519Z","attemptedAt":"2026-11-10T16:55:32.519Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T16:55:32.518Z","attemptedAt":"2026-11-10T16:55:32.518Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T16:55:32.519Z","attemptedAt":"2026-11-10T16:55:32.519Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T16:55:32.852Z","attemptedAt":"2026-11-10T16:55:32.852Z"}],"evidence":[],"aiSummary":{"text":"In @neo4j/graphql versions 5.0.0 before 5.12.17 and 7.0.0 before 7.6.8, aggregation queries can bypass authentication restrictions, allowing attackers to read protected data. Field-level authentication is not enforced on string aggregates. This weakness may allow unauthenticated callers to obtain aggregate results.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T16:56:08.818Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-92684"}]}}