CVE-2026-92682
2026-10-12
16h17 +00:00
16h17 +00:00
특정 CVE 알림
특정 CVE의 변경 사항에 대한 정보를 받아보세요.
CVE 설명
In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.
CVE 정보
관련 약점
| 약점 이름 | 출처 | |
|---|---|---|
| Incorrect Authorization The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
