Answer in brief
CVE-2026-92682 records a High severity (CVSS 8.6) vulnerability in @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier. The current sources do not mark it as known exploited. The current feed maps Neo4j/@neo4j/graphql (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Neo4j/@neo4j/graphql (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Neo4j/@neo4j/graphqlgeneric | >=7.0.0 <7.6.4 | 7.6.4 |
Published upstream
Oct 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 12, 2026
In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.
Quoted source text, attributed separately from HOL analysis.