Authorization Bypass Through User-Controlled Key Affecting @neo4j/graphql package, versions >=5.2.0 <5.12.15>=6.0.0 <7.6.0

@neo4j/graphql is an A GraphQL to Cypher query execution layer for Neo4j and JavaScript GraphQL implementations

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the isAuthenticated check in packages/graphql/src/translate/authorization/check-authentication.ts. An attacker can invoke a root custom-resolver field protected by a stricter field-level @authentication rule by sending a valid token that satisfies only the type-level @authentication on the enclosing Query or Mutation. When both annotations are present on the same operation type, the field-level rule is dropped, and the resolver runs under the broader type-level check alone. This lets an authenticated user access admin-only root fields or trigger restricted root mutations, exposing data or performing operations that the schema intended to reserve for more privileged callers.

Workarounds

• Do not combine a type-level @authentication on a root Query/Mutation with a field-level @authentication on the same operation type; remove the broad type-level rule and apply the full @authentication directive to each root field individually so the stricter per-field requirement is actually enforced.
• Alternatively, enforce the stricter requirement inside the custom resolver’s own code so access to the sensitive root field is checked independently of the enclosing type-level authentication rule.

• GitHub Commit @neo4j/graphql
• GitHub Commit @neo4j/graphql
• Maintainer's Advisory