{"id":"CVE-2026-19869","title":"@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type","summary":"@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-le…","severity":"none","cwe":["CWE-639"],"published":"2026-08-18","updated":"2026-09-09","sourceUpdated":"2026-09-09T16:03:22.897","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19869","references":[{"url":"https://github.com/neo4j/graphql/security/advisories/GHSA-82m8-p9px-c3x5","label":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"},{"url":"https://neo4j.com/security/CVE-2026-19869","label":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}],"tags":["nvd"],"epss":0.00279,"epssPercentile":0.20623,"ingestedAt":"2026-09-09T16:14:05.513Z","slug":"CVE-2026-19869","body":"## Overview\n\n@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on Query/Mutation) and a field-level @authentication (on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement — such as an admin-role JWT claim (jwt: { roles_INCLUDES: \"admin\" }) — is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g. roles: [\"user\"]) is sufficient.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}