# CVE-2026-1524: Neo4j Enterprise Edition incorrect authorization in SSO implementation

Source: https://junglewise.ai/threats/cve-2026-1524-neo4j-enterprise-edition-incorrect-authorization-in-sso  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-11. Updated: 2026-05-22  
License: CC BY 4.0 with a link back

CVE-2026-1524 · Severity: info · CVSS 9.8 · Published 2026-03-11

A security flaw in Neo4j Enterprise Edition's Single Sign-On (SSO) system can allow users to gain higher access privileges than intended. This occurs when the database is configured to use multiple identity providers, causing the system to mistakenly grant administrative or elevated permissions from a provider that was only supposed to verify a user's identity. If exploited, an unauthorized user could gain full control over the database and its sensitive information.

## Quick answers

**Is CVE-2026-1524 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1524 being exploited in the wild.

**How severe is CVE-2026-1524?** Informational severity, with a CVSS score of 9.8, published 11 March 2026.

**Which products and versions are affected?** Neo4j Neo4j Enterprise Edition prior to 2026.02, prior to 5.26.22.

**Is there a fix for CVE-2026-1524?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-1524 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-1524?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability exists in Neo4j Enterprise Edition's SSO implementation. When an administrator configures multiple OIDC providers or plugins where at least one is set for authorization and another is set for authentication-only, the system may erroneously use the authentication-only provider to grant authorization permissions. If the authentication-only provider contains groups with higher privileges than the intended authorization provider, a user can achieve privilege escalation. This issue affects versions prior to 2026.02 and 5.26.22. The vulnerability is reachable over the network without specific user interaction, provided the specific multi-provider configuration is active.

## Affected products

- Neo4j Neo4j Enterprise Edition prior to 2026.02, prior to 5.26.22

## Timeline

- 2026-03-11: disclosed: Initial disclosure by Neo4j
- 2026-03-11: advisory: Vendor advisory published
- 2026-05-22: other: NVD analysis and CPE assignment

## References

- [https://neo4j.com/security/CVE-2026-1524](https://neo4j.com/security/CVE-2026-1524)