Privilege Escalation Vulnerability in @neo4j/graphql (CVE-2026-13669)

Vulnerability Overview Vulnerability Name: Privilege Escalation via Dropped Field-Level @authentication on Root Custom-Resolver Fields in @neo4j/graphql Description: A vulnerability exists in the library in versions from 5.2.8 to 5.12.15, as well as 7.0.0 to 7.6.0. This vulnerability allows privilege escalation by bypassing field-level rules. Specifically, when type-level rules and field-level rules are present simultaneously, only the type-level rule is evaluated, while the field-level rule is ignored. This results in clients that satisfy the less restrictive type-level requirements being able to access more restricted fields, even if administrator JWT claims (e.g., ) are not checked. Scope of Impact Affected Versions: - (npm) - >= 5.2.0, = 7.0.0, < 7.6.0 CVSS v4 Base Metrics: - Severity: High (7.6 / 10) - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Vulnerable System Impact Metrics: - Confidentiality: High - Integrity: High - Availability: None - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None CVE ID: CVE-2026-13669 Remediation Fixed Versions: - (npm) - 5.12.15 - 7.6.0 Recommendations: - Upgrade to version 7.5.7, 5.12.15, or higher. - For users unable to upgrade immediately, it is recommended not to combine type-level and field-level on the same root operation type. - Apply the complete directive to each root field, including the full strict rules. - Alternatively, enforce stricter requirements in the custom resolver code. Proof of Concept (POC) Code No specific POC code or exploit code was provided in the source.

Goal Reached Thanks to every supporter — we hit 100%!

Privilege Escalation Vulnerability in @neo4j/graphql (CVE-2026-13669)

More from this source