CVE-2026-92684

{
  "etk_id": "ETK-2026-4073",
  "cve_id": "CVE-2026-92684",
  "display_id": "CVE-2026-92684",
  "ghsa_id": "GHSA-9r8x-hf5g-rh66",
  "euvd_id": "EUVD-2026-121400",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in Neo4j GraphQL aggregation queries",
  "summary": "@neo4j/graphql versions 5.0.0 through 5.12.16 and 7.0.0 through 7.6.7 can fail to enforce authentication rules for some GraphQL aggregation queries. An unauthenticated attacker may read protected stored values or aggregate results if they can submit queries to an affected GraphQL API.",
  "mitigation": "Upgrade @neo4j/graphql to version 5.12.17 or later in the 5.x line, or 7.6.8 or later in the 7.x line. Restrict unauthenticated access to GraphQL endpoints until the upgrade is deployed.",
  "vendor": "Neo4j",
  "product": "@neo4j/graphql",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0, <= 5.12.16"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "5.12.17"
      ],
      "package_name": "@neo4j/graphql",
      "purl": "pkg:npm/@neo4j/graphql"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 7.0.0, <= 7.6.7"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "7.6.8"
      ],
      "package_name": "@neo4j/graphql",
      "purl": "pkg:npm/@neo4j/graphql"
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.730691983333333,
  "t0_at": "2026-11-10T16:46:02.458000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-10T16:46:02.458000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-10T16:46:02.458000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92684"
    }
  }
}