---
id: CVE-2026-19869
title: "@neo4j/graphql\_from\_5.2.0\_until the patched versions fails to enforce field-level\_@authentication\_rules on root custom-resolver fields when a type-level\_@authentication\_rule is also present on the same operation type"
summary: "@neo4j/graphql\_from\_5.2.0\_until the patched versions fails to enforce field-level\_@authentication\_rules on root custom-resolver fields when a type-level\_@authentication\_rule is also present on the same operation type. When both a type-le…"
severity: none
cwe:
  - CWE-639
published: '2026-08-18'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T16:03:22.897'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19869'
references:
  - url: 'https://github.com/neo4j/graphql/security/advisories/GHSA-82m8-p9px-c3x5'
    label: 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6
  - url: 'https://neo4j.com/security/CVE-2026-19869'
    label: 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6
tags:
  - nvd
epss: 0.00488
epssPercentile: 0.39447
ingestedAt: '2026-09-09T16:14:05.513Z'
---

## Overview

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on Query/Mutation) and a field-level @authentication (on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement — such as an admin-role JWT claim (jwt: { roles_INCLUDES: "admin" }) — is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g. roles: ["user"]) is sufficient.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.