# CVE-2026-92682: Neo4j GraphQL authorization filter logic inversion on relationships

Source: https://junglewise.ai/threats/cve-2026-92682-in-neo4j-graphql-versions-from-7-0-0-up-to-but-not-including-7-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-92682 · Severity: info · Published 2026-10-12

Neo4j GraphQL is a library for building GraphQL APIs on top of Neo4j databases. A logic error in authorization rules causes the "none" filter on relationships to behave like "some," allowing authenticated users to read, create, and delete data they should not have access to based on the defined authorization policy.

Technologies: [Neo4j @Neo4j/Graphql](https://junglewise.ai/threats/technologies/neo4j-graphql). Vendors: [Neo4j](https://junglewise.ai/threats/vendors/neo4j).

## Quick answers

**Is CVE-2026-92682 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92682 being exploited in the wild.

**How severe is CVE-2026-92682?** Informational severity, published 12 October 2026.

**Which products and versions are affected?** Neo4j @Neo4j/Graphql 7.0.0 to 7.6.3.

**Is there a fix for CVE-2026-92682?** Yes: fixed in 7.6.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92682 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92682?** Check whether you run Neo4j @Neo4j/Graphql at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.6.4

## Technical details

The @neo4j/graphql library fails to negate the "none" quantifier when translating @authorization filters on relationships and connections to Cypher queries, causing the generated query logic to be inverted. An authenticated attacker matching an authorization rule intended to deny them access can bypass the control to read, mutate, and delete protected records. The vulnerability affects versions 7.0.0 through 7.6.3.

## Affected products

- Neo4j GraphQL 7.0.0 to 7.6.3

## Timeline

- 2026-10-12: disclosed

## References

- [https://registry.npmjs.org/](https://registry.npmjs.org/)
- [https://github.com/neo4j/graphql/commit/17650cc370445a6bb9d394d34063d3623e987aa2](https://github.com/neo4j/graphql/commit/17650cc370445a6bb9d394d34063d3623e987aa2)

## Related threats

- [Neo4j @neo4j/graphql authentication bypass in aggregation queries](https://junglewise.ai/threats/cve-2026-92684-missing-authentication-for-critical-function-in-aggregation)
- [Neo4j @neo4j/graphql authorization bypass in @authentication JWT filter](https://junglewise.ai/threats/cve-2026-92683-incorrect-authorization-in-the-authentication-directive-jwt-where)
- [Neo4j GraphQL authentication bypass in @cypher fields](https://junglewise.ai/threats/cve-2026-92681-in-neo4j-graphql-versions-up-to-and-including-7-6-3)
- [@neo4j/graphql subscription authentication bypass via unverified JWT](https://junglewise.ai/threats/cve-2026-5423-neo4j-graphql-subscription-authentication-bypass-via-unverified)