Executive brief
A security flaw in Neo4j Enterprise Edition can cause users to mistakenly inherit the permissions and identity of the first person who logged in after a system restart. This occurs in specific Single Sign-On (SSO) configurations and could allow a regular user to access sensitive data or perform actions intended for a different, potentially more privileged, user. Organizations using SSO with the UserInfo endpoint should update to the latest version to ensure proper user isolation.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Neo4j Enterprise Edition due to excessive caching of authentication contexts. When configured with Single Sign-On (SSO) using the UserInfo endpoint, the system fails to properly isolate session contexts, leading subsequent authenticated users to inherit the context of the initial user who authenticated after a service restart. The attack requires the attacker to be authenticated and the system to be using a non-default SSO configuration where 'get_groups_from_user_info' or 'get_username_from_user_info' is enabled. This can result in unauthorized data access or privilege escalation. The issue is resolved in versions 2026.01.4 and 5.26.22.
Affected products
- Neo4j Neo4j Enterprise Edition versions before 2026.01.4, versions before 5.26.22
Timeline
- 2026-03-11: disclosed
- 2026-03-11: advisory
- 2026-03-11: patched