---
id: CVE-2026-92682
title: >-
  In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none
  quantifier in @authorization filters on relationships and connections is not
  negated when translated to Cypher, so it behaves like some
summary: >-
  In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none
  quantifier in @authorization filters on relationships and connections is not
  negated when translated to Cypher, so it behaves like some. A rule such as
  "none o…
severity: none
cwe:
  - CWE-863
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T16:17:07.480'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92682'
references:
  - url: >-
      https://github.com/neo4j/graphql/commit/17650cc370445a6bb9d394d34063d3623e987aa2
    label: 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6
  - url: 'https://github.com/neo4j/graphql/releases/tag/%40neo4j%2Fgraphql%407.6.4'
    label: 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6
  - url: 'https://github.com/neo4j/graphql/security/advisories/GHSA-h873-p2wr-fjx6'
    label: 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6
  - url: 'https://www.npmjs.com/package/@neo4j/graphql'
    label: 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6
tags:
  - nvd
ingestedAt: '2026-10-12T16:57:59.920Z'
---

## Overview

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.