# CVE-2026-1471: Neo4j Enterprise Edition incorrect authorization in SSO authentication context

Source: https://junglewise.ai/threats/cve-2026-1471-neo4j-enterprise-edition-incorrect-authorization-in-sso  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-11. Updated: 2026-05-22  
License: CC BY 4.0 with a link back

CVE-2026-1471 · Severity: info · CVSS 6.5 · Published 2026-03-11

A security flaw in Neo4j Enterprise Edition can cause users to mistakenly inherit the permissions and identity of the first person who logged in after a system restart. This occurs in specific Single Sign-On (SSO) configurations and could allow a regular user to access sensitive data or perform actions intended for a different, potentially more privileged, user. Organizations using SSO with the UserInfo endpoint should update to the latest version to ensure proper user isolation.

Vendors: [Neo4j](https://junglewise.ai/threats/vendors/neo4j).

## Quick answers

**Is CVE-2026-1471 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1471 being exploited in the wild.

**How severe is CVE-2026-1471?** Informational severity, with a CVSS score of 6.5, published 11 March 2026.

**Which products and versions are affected?** Neo4j Enterprise Edition versions before 2026.01.4, versions before 5.26.22.

**Is there a fix for CVE-2026-1471?** A patch was published on 2026-03-11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-1471 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-1471?** Check whether you run Neo4j Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability (CWE-863) exists in Neo4j Enterprise Edition due to excessive caching of authentication contexts. When configured with Single Sign-On (SSO) using the UserInfo endpoint, the system fails to properly isolate session contexts, leading subsequent authenticated users to inherit the context of the initial user who authenticated after a service restart. The attack requires the attacker to be authenticated and the system to be using a non-default SSO configuration where 'get_groups_from_user_info' or 'get_username_from_user_info' is enabled. This can result in unauthorized data access or privilege escalation. The issue is resolved in versions 2026.01.4 and 5.26.22.

## Affected products

- Neo4j Neo4j Enterprise Edition versions before 2026.01.4, versions before 5.26.22

## Timeline

- 2026-03-11: disclosed
- 2026-03-11: advisory
- 2026-03-11: patched

## References

- [https://neo4j.com/security/CVE-2026-1471](https://neo4j.com/security/CVE-2026-1471)