CVE-2026-19869

Name of the Vulnerable Software and Affected Versions @neo4j/graphql versions 5.2.0 through the patched versions

Description An issue exists where field-level @authentication rules on root custom-resolver fields are not enforced when a type-level @authentication rule is also present on the same operation type. In scenarios where both a type-level rule (on Query or Mutation) and a field-level rule (on a root custom-resolver field within that type) are declared, the system only evaluates the type-level rule and silently discards the field-level rule. This allows clients that satisfy the broader type-level requirement to access restricted fields, bypassing stricter per-field requirements such as specific admin-role JWT claims (e.g., jwt: { roles INCLUDES: "admin" }). This occurs even with legitimately issued and signed non-admin tokens.

Recommendations Update @neo4j/graphql to the patched version.