{"id":"CVE-2026-92683","kind":"vulnerability","aliases":["CVE-2026-92683"],"related":[],"title":"Neo4j GraphQL library: JWT filter checks skipped, bypassing access rules","description":"Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax.","summary":"In @neo4j/graphql versions 7.0.0 before 7.6.7, a JWT authorization filter with multiple conditions only enforces the first one. An attacker holding an otherwise valid JWT can read or act on data that the remaining conditions should have blocked.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graphql","jwt","neo4j","node.js","package"],"not_affected_if":["no-jwt-where-filter","version-outside-range"],"how_to_check":"- Check the installed version: `npm ls @neo4j/graphql`\n- Look for `@authentication` directives with multiple conditions in a `jwt` `where` filter, written in generic operator syntax","fix":"- `@neo4j/graphql` `7.6.7` or later (from the affected range 7.0.0 before 7.6.7)","status":"open","published_at":"2026-11-09T10:17:15+00:00","first_seen_at":"2026-11-09T10:25:50+00:00","triaged_at":"2026-11-09T10:26:06+00:00","updated_at":"2026-11-09T10:26:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T10:26:06Z","model":"claude-haiku-5-5","output":{"fix":"- `@neo4j/graphql` `7.6.7` or later (from the affected range 7.0.0 before 7.6.7)","reach":"internet","title":"Neo4j GraphQL library: JWT filter checks skipped, bypassing access rules","impact":"medium","summary":"In @neo4j/graphql versions 7.0.0 before 7.6.7, a JWT authorization filter with multiple conditions only enforces the first one. An attacker holding an otherwise valid JWT can read or act on data that the remaining conditions should have blocked.","audience":"developers","category":"package","nicknames":[],"who_cares":["neo4j","graphql","node.js","jwt"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authorization filters bypassed, exposing data beyond the user's permissions","analyst_note":"","how_to_check":"- Check the installed version: `npm ls @neo4j/graphql`\n- Look for `@authentication` directives with multiple conditions in a `jwt` `where` filter, written in generic operator syntax","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-jwt-where-filter","version-outside-range"],"who_is_affected":"Applications that use @neo4j/graphql 7.x with the @authentication directive and JWT-based where filters written in generic operator syntax. Apps without JWT authorization filters, or on versions outside 7.0.0 to 7.6.6, are not affected by this description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4584,"output_tokens":550,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-92683':13A,16A '7.0.0':25B,74C '7.6.7':27B,76C 'access':9A 'act':50B 'allow':77C 'attack':41B,79C 'authent':64C 'author':30B,61C 'block':59B 'bypass':8A,87C 'check':6A 'condit':34B,56B,93C,98C 'cve':11A,14A 'data':52B 'direct':65C 'enforc':36B 'evalu':69C 'filter':5A,31B,68C,92C,101C 'first':38B,91C 'generic':104C 'graphql':2A,17B 'hold':42B,80C 'incorrect':60C 'jwt':4A,18B,29B,46B,66C,85C,99C 'librari':3A 'multi':97C 'multi-condit':96C 'multipl':33B 'neo4j':1A,19B,71C 'neo4j/graphql':23B,72C 'node.js':20B 'one':39B 'oper':105C 'otherwis':44B,83C 'otherwise-valid':82C 'packag':21B 'read':48B 'remain':55B 'rule':10A 'skip':7A 'syntax':106C 'valid':45B,84C 'version':24B,73C 'via':94C 'written':102C","nicknames":[],"mitigations":[],"who_affected":"Applications that use @neo4j/graphql 7.x with the @authentication directive and JWT-based where filters written in generic operator syntax. Apps without JWT authorization filters, or on versions outside 7.0.0 to 7.6.6, are not affected by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["graphql","high","jwt","neo4j","nodejs","package"],"campaign_type":null,"search_a":"'-2026':12A,15A '-92683':13A,16A 'access':9A 'bypass':8A 'check':6A 'cve':11A,14A 'filter':5A 'graphql':2A 'jwt':4A 'librari':3A 'neo4j':1A 'rule':10A 'skip':7A","search_b":"'7.0.0':25B '7.6.7':27B 'act':50B 'attack':41B 'author':30B 'block':59B 'condit':34B,56B 'data':52B 'enforc':36B 'filter':31B 'first':38B 'graphql':17B 'hold':42B 'jwt':18B,29B,46B 'multipl':33B 'neo4j':19B 'neo4j/graphql':23B 'node.js':20B 'one':39B 'otherwis':44B 'packag':21B 'read':48B 'remain':55B 'valid':45B 'version':24B","search_c":"'7.0.0':74C '7.6.7':76C 'allow':77C 'attack':79C 'authent':64C 'author':61C 'bypass':87C 'condit':93C,98C 'direct':65C 'evalu':69C 'filter':68C,92C,101C 'first':91C 'generic':104C 'hold':80C 'incorrect':60C 'jwt':66C,85C,99C 'multi':97C 'multi-condit':96C 'neo4j':71C 'neo4j/graphql':72C 'oper':105C 'otherwis':83C 'otherwise-valid':82C 'syntax':106C 'valid':84C 'version':73C 'via':94C 'written':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-05T18:56:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92683","severity":null,"published_at":"2026-11-09T10:17:15+00:00","modified_at":"2026-11-09T10:17:15+00:00","first_seen_at":"2026-11-09T10:25:50+00:00","fetched_at":"2026-11-09T10:25:50+00:00","note":null}],"documents":[{"id":106902,"url":"https://github.com/neo4j/graphql/security/advisories/GHSA-58qp-3mmm-5vh8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-05T18:56:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}