graphql vulnerabilities

2 known vulnerabilities in graphql from Neo4j. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.6 High severity

  graphql: Authorization Bypass Through User-Controlled Key

  CVE-2026-19869Aug 18, 2026Neo4j

  @neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on

• 8.2 High severity

  graphql: Authentication Bypass by Assumed-Immutable Data

  CVE-2026-5423Aug 6, 2026Neo4j

  @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSoc