VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/19xxx/CVE-2026-19869.json
T

235 lines
13 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-19869",
"assignerOrgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6",
"state": "PUBLISHED",
"assignerShortName": "Neo4j",
"dateReserved": "2026-08-14T11:22:26.042Z",
"datePublished": "2026-08-18T16:35:19.878Z",
"dateUpdated": "2026-08-19T16:02:04.528Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6",
"shortName": "Neo4j",
"dateUpdated": "2026-08-19T16:02:04.528Z"
},
"title": "Privilege Escalation via Dropped Field-Level @authentication",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"affected": [
{
"vendor": "neo4j",
"product": "graphql",
"collectionURL": "https://registry.npmjs.org",
"packageName": "@neo4j/graphql",
"repo": "https://github.com/neo4j/graphql",
"versions": [
{
"status": "affected",
"version": "7.0.0",
"lessThan": "7.6.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.2.0",
"lessThan": "5.12.15",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.0",
"lessThanOrEqual": "6.6.4",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:neo4j:graphql:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.0",
"versionEndExcluding": "7.6.0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:neo4j:graphql:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.2.0",
"versionEndExcluding": "5.12.15"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:neo4j:graphql:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.0",
"versionEndIncluding": "6.6.4"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on Query/Mutation) and a field-level @authentication (on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement — such as an admin-role JWT claim (jwt: { roles_INCLUDES: \"admin\" }) — is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g. roles: [\"user\"]) is sufficient.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<code>@neo4j/graphql</code>&nbsp;from&nbsp;<code>5.2.0</code>&nbsp;until the patched versions fails to enforce field-level&nbsp;<code>@authentication</code>&nbsp;rules on root custom-resolver fields when a type-level&nbsp;<code>@authentication</code>&nbsp;rule is also present on the same operation type. When both a type-level&nbsp;<code>@authentication</code>&nbsp;(on&nbsp;<code>Query</code>/<code>Mutation</code>) and a field-level&nbsp;<code>@authentication</code>&nbsp;(on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement — such as an admin-role JWT claim (<code>jwt: { roles_INCLUDES: \"admin\" }</code>) — is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g.&nbsp;<code>roles: [\"user\"]</code>) is sufficient."
}
]
}
],
"references": [
{
"url": "https://github.com/neo4j/graphql/security/advisories/GHSA-82m8-p9px-c3x5",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://neo4j.com/security/CVE-2026-19869",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 7.6,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
}
}
],
"configurations": [
{
"lang": "en",
"value": "The application enables features.authorization and defines a root operation type (Query/Mutation) annotated with @authentication that also contains one or more custom-resolver fields carrying their own, stricter @authentication rule.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>The application enables&nbsp;<code>features.authorization</code>&nbsp;and defines a root operation type (<code>Query</code>/<code>Mutation</code>) annotated with&nbsp;<code>@authentication</code>&nbsp;that also contains one or more custom-resolver fields carrying their own, stricter&nbsp;<code>@authentication</code>&nbsp;rule.</p>"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade the library to 7.6.0+ or 5.12.15+. v6 is end-of-life and will not receive a fix. v5 releases prior to 5.2.0 are not affected.\n\n\n\nFor users who cannot upgrade immediately: do not combine a type-level @authentication with a field-level @authentication on the same root operation type. Because the type-level annotation is what shadows the field-level rule, removing it restores correct enforcement — instead apply a complete @authentication directive to each root field individually, including the full stricter rule on the sensitive field. Alternatively, enforce the stricter requirement inside the custom resolver's own code.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Upgrade the library to&nbsp;<code>7.6.0</code>+ or&nbsp;<code>5.12.15</code>+. v6 is end-of-life and will not receive a fix. v5 releases prior to&nbsp;<code>5.2.0</code>&nbsp;are not affected.</p><p>For users who cannot upgrade immediately: do not combine a type-level&nbsp;<code>@authentication</code>&nbsp;with a field-level&nbsp;<code>@authentication</code>&nbsp;on the same root operation type. Because the type-level annotation is what shadows the field-level rule, removing it restores correct enforcement — instead apply a complete&nbsp;<code>@authentication</code>&nbsp;directive to each root field individually, including the full stricter rule on the sensitive field. Alternatively, enforce the stricter requirement inside the custom resolver's own code.</p>"
}
]
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-08-18T19:09:25.351012Z",
"id": "CVE-2026-19869",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-08-18T19:09:31.066Z"
}
}
]
}
}
View Git Blame Copy Permalink