Key points
- CVE-2026-92681 carries a CVSS score of 9.3, rated critical by the NVD.
- Schema-level authentication directives are ignored for top-level @cypher fields in affected versions.
- The vulnerability is fixed in version 7.6.4 of the @neo4j/graphql library.
The Neo4j GraphQL library contains a critical authentication bypass flaw that allows unauthenticated users to execute Cypher statements. This vulnerability affects versions up to and including 7.6.3 and is identified as CVE-2026-92681.
According to the National Vulnerability Database, the issue stems from how authentication directives are processed. Directives applied at the schema level or on Query and Mutation types are silently ignored for top-level fields annotated with @cypher. Only directives placed directly on individual fields are enforced in these older versions.
Technical Details of the Flaw
The weakness is classified as CWE-306, indicating an incorrect default permissions issue. When an application exposes a top-level @cypher field and relies on broader authentication rules, it fails to protect that specific endpoint. Unauthenticated callers can invoke the field and run the configured Cypher statement.
This execution occurs with the privileges of the GraphQL service account. Consequently, attackers may be able to read or modify data within the database. The flaw exists because the library does not apply the intended security controls to these specific field types in versions prior to the patch.
Who Is Affected
Organisations using the @neo4j/graphql library in versions before 7.6.4 are exposed to this risk. If their GraphQL schemas include top-level @cypher fields protected only by schema-level or type-level authentication, those protections are ineffective.
Developers who have placed @authentication directives directly on the individual fields are not affected by this specific bypass. However, teams relying on the default or broader authentication patterns must verify their versions immediately.
What happens next
The vendor has released version 7.6.4, which fixes the authentication bypass. Users of the library should upgrade to this version to ensure that schema-level and type-level directives are correctly enforced for all field types.
Until the update is applied, organisations should assess their GraphQL schemas for exposed top-level @cypher fields. Temporary mitigation may involve moving authentication directives to the individual fields, though upgrading is the recommended path.
What to do and how to stay safe: Neo4j
- Audit GraphQL schemas for top-level @cypher fields and check their authentication configurations.
- Upgrade the @neo4j/graphql library to version 7.6.4 or later as soon as possible.
- Monitor application logs for unauthenticated requests to sensitive GraphQL endpoints.
- Verify that authentication directives are explicitly applied to individual fields if upgrading is delayed.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-92681?
The CVSS score is 9.3, which is rated as critical severity.
Which versions of Neo4j GraphQL are vulnerable?
Versions up to and including 7.6.3 are affected by this authentication bypass.
How does the fix in 7.6.4 address the issue?
Version 7.6.4 ensures that schema-level and type-level authentication directives are enforced for top-level @cypher fields.
