CVE-2026-1524

LOW EPSS 23.2%
Published Mar 11, 20263mo ago · Modified May 22, 20261mo ago
2.1 CVSS 4.0
Low
Find Similar
Published Mar 11, 2026 3mo ago
Last Modified May 22, 2026 1mo ago

Description

An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider. When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.  We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.

CVSS Details

Base Score
2.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Green
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
23.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 2

CWE-287 Improper Authentication Authentication
CWE-863 Incorrect Authorization Authorization

Affected Products 2

VendorProductVersionRange
neo4jneo4j* <5.26.22
neo4jneo4j*≥2025.01.0  –  <2026.02

References 1

  • neo4j.com https://neo4j.com/security/CVE-2026-1524
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.