Is CVE-2026-1471 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1471 being exploited in the wild.

How severe is CVE-2026-1471?

Informational severity, with a CVSS score of 6.5, published 11 March 2026.

Which products and versions are affected?

Neo4j Enterprise Edition versions before 2026.01.4, versions before 5.26.22.

Is there a fix for CVE-2026-1471?

A patch was published on 2026-03-11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-1471 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-1471?

Check whether you run Neo4j Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1471: Neo4j Enterprise Edition incorrect authorization in SSO authentication context

CVE-2026-1471 · Severity: info · CVSS 6.5 · Published 2026-03-11

A security flaw in Neo4j Enterprise Edition can cause users to mistakenly inherit the permissions and identity of the first person who logged in after a system restart. This occurs in specific Single Sign-On (SSO) configurations and could allow a regular user to access sensitive data or perform actions intended for a different, potentially more privileged, user. Organizations using SSO with the UserInfo endpoint should update to the latest version to ensure proper user isolation.

Vendors: Neo4j.

Quick answers

Is CVE-2026-1471 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1471 being exploited in the wild.
How severe is CVE-2026-1471?: Informational severity, with a CVSS score of 6.5, published 11 March 2026.
Which products and versions are affected?: Neo4j Enterprise Edition versions before 2026.01.4, versions before 5.26.22.
Is there a fix for CVE-2026-1471?: A patch was published on 2026-03-11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1471 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-1471?: Check whether you run Neo4j Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in Neo4j Enterprise Edition due to excessive caching of authentication contexts. When configured with Single Sign-On (SSO) using the UserInfo endpoint, the system fails to properly isolate session contexts, leading subsequent authenticated users to inherit the context of the initial user who authenticated after a service restart. The attack requires the attacker to be authenticated and the system to be using a non-default SSO configuration where 'get_groups_from_user_info' or 'get_username_from_user_info' is enabled. This can result in unauthorized data access or privilege escalation. The issue is resolved in versions 2026.01.4 and 5.26.22.

Affected products

Neo4j Neo4j Enterprise Edition versions before 2026.01.4, versions before 5.26.22

Timeline

2026-03-11: disclosed
2026-03-11: advisory
2026-03-11: patched

References

https://neo4j.com/security/CVE-2026-1471

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.