{"id":"CVE-2026-92684","published":"2026-11-10T17:17:50.150","lastModified":"2026-11-10T17:17:50.150","description":"Missing Authentication for Critical Function in aggregation queries in Neo4j @neo4j/graphql 5.0.0 before 5.12.17 and 7.0.0 before 7.6.8 allows remote attackers to read protected data via GraphQL aggregation queries. Field-level @authentication is not enforced on string aggregates, which can return stored values verbatim, and connection-root aggregates bypass an entity's AGGREGATE authentication requirement, allowing unauthenticated callers to obtain aggregate results.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/neo4j/graphql/security/advisories/GHSA-9r8x-hf5g-rh66","tags":[]}],"exploitRefs":[{"url":"https://github.com/neo4j/graphql/security/advisories/GHSA-9r8x-hf5g-rh66","tags":[]}],"hasPoc":true,"ai":null}