{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://registry.npmjs.org","packageName":"@neo4j/graphql","product":"@neo4j/graphql","source":"CNA: Neo4j","vendor":"Neo4j","versions":[{"lessThan":"5.12.17","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThan":"7.6.8","status":"affected","version":"7.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-92684","cwes":["CWE-306"],"description":"Missing Authentication for Critical Function in aggregation queries in Neo4j @neo4j/graphql 5.0.0 before 5.12.17 and 7.0.0 before 7.6.8 allows remote attackers to read protected data via GraphQL aggregation queries. Field-level @authentication is not enforced on string aggregates, which can return stored values verbatim, and connection-root aggregates bypass an entity's AGGREGATE authentication requirement, allowing unauthenticated callers to obtain aggregate results.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: Neo4j","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":8.7,"severity":"high","source":"NVD: 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794331070150,"publishedAt":1794329162458,"references":[{"source":"CNA: Neo4j","tags":["vendor-advisory"],"url":"https://github.com/neo4j/graphql/security/advisories/GHSA-9r8x-hf5g-rh66"},{"source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","tags":[],"url":"https://github.com/neo4j/graphql/security/advisories/GHSA-9r8x-hf5g-rh66"}],"remediation":[{"kind":"fix","source":"CNA: Neo4j","text":"Upgrade @neo4j/graphql to 7.6.8 (latest) or 5.12.17 (LTS)."},{"kind":"workaround","source":"CNA: Neo4j","text":"Restrict access to aggregate queries over protected data until the upgrade is applied."}],"revision":"52ae321a79d15938a5c09a7da28475ee2d8c84c41dccfc670e7c8306ce85d01b","sources":[{"modifiedAt":1794329162458,"name":"CNA: Neo4j","retrievedAt":1794330864134,"url":"https://www.cve.org/CVERecord?id=CVE-2026-92684"},{"modifiedAt":1794331070150,"name":"NVD","retrievedAt":1794336331737,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92684"}],"ssvc":null,"status":"published","title":"Aggregation queries can bypass authentication restrictions in @neo4j/graphql","updatedAt":1794336331737}