The @neo4j/graphql library contains an authentication bypass flaw that permits unauthorized data manipulation, necessitating an immediate version update.

This is an authentication bypass vulnerability (CWE-302) caused by the handling of assumed-immutable data. The flaw is remotely exploitable by an unauthenticated attacker over the network.

This vulnerability allows attackers to bypass security checks, potentially leading to unauthorized data modification or administrative access. With a CVSS score of 8.2, the risk of data compromise is high, particularly for applications relying on the graphql library for database interactions.

Immediate Action: Update the @neo4j/graphql library to version 5.12.14 or 7.5.6. Users on the 6.x branch must migrate to the 5.x or 7.x LTS versions as 6.x is end-of-life.

Proactive Monitoring: Audit database logs for suspicious mutations or unexpected data access patterns originating from the graphql interface.

Compensating Controls: Implement strict input validation and access control policies at the application layer to mitigate unauthorized requests.

Public Exploit Available: No (exploit_available: false)

Due to the critical nature of authentication bypass, all affected users should prioritize upgrading their dependencies. Organizations currently utilizing the 6.x branch must treat this as a high-priority migration task to ensure continued security support and protection.