CVE-2026-1524: Authorization Bypass in Neo4j Enterprise Edition

The vulnerability stems from a misconfiguration scenario within Neo4j's SSO functionality. If an administrator configures multiple OIDC providers, designates some as authorization providers, and others as authentication-only, the authentication-only providers can inadvertently grant authorization privileges. This occurs when these authentication-only providers contain groups with elevated privileges exceeding those intended by the administrator's authorization configuration. An attacker could exploit this by leveraging a compromised or malicious authentication-only provider to gain administrative access to the Neo4j instance, potentially leading to data breaches, system compromise, and denial of service. The blast radius extends to any sensitive data stored and managed within the Neo4j graph database.

1. Reserved2026-01-28
2. Published2026-03-11
3. Modified2026-03-12
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-1524 is to upgrade Neo4j Enterprise Edition to version 2026.02 or later, which contains the fix. If an immediate upgrade is not feasible, carefully review and correct the OIDC provider configuration. Ensure that only intended authorization providers are configured for authorization, and that authentication-only providers do not inadvertently grant elevated privileges. Implement strict access controls and regularly audit SSO configurations to prevent future misconfigurations. Consider implementing a Web Application Firewall (WAF) with rules to detect and block requests attempting to exploit this bypass, although this is not a substitute for patching.