Privilege Escalation via Dropped Field-Level @authentication

Description

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on Query/Mutation) and a field-level @authentication (on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement — such as an admin-role JWT claim (jwt: { roles_INCLUDES: "admin" }) — is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g. roles: ["user"]) is sufficient.

Timeline

Scores

EPSS (exploitation in 30 days)

0.49% · top 58% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.6.

Weakness

• CWE-639 Authorization bypass through User-Controlled key (opens in a new tab)All about CWE-639 and its CVEs

Affected products

• neo4j · graphql

  • affected 7.0.0 – < 7.6.0
  • affected 5.2.0 – < 5.12.15
  • affected 6.0.0 – ≤ 6.6.4

What to do

Solution: Upgrade the library to 7.6.0+ or 5.12.15+. v6 is end-of-life and will not receive a fix. v5 releases prior to 5.2.0 are not affected. For users who cannot upgrade immediately: do not combine a type-level @authentication with a field-level @authentication on the same root operation type. Because the type-level annotation is what shadows the field-level rule, removing it restores correct enforcement — instead apply a complete @authentication directive to each root field individually, including the full stricter rule on the sensitive field. Alternatively, enforce the stricter requirement inside the custom resolver's own code.

References (2)

• https://github.com/neo4j/graphql/security/advisories/GHSA-82m8-p9px-c3x5 (opens in a new tab)third-party-advisory
• https://neo4j.com/security/CVE-2026-19869 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-19869](https://trackcve.app/badge/CVE-2026-19869.svg)](https://trackcve.app/cve/CVE-2026-19869)

Record last updated 19 Aug 2026, 16:02 UTC.