This is a CWE-639 Authorization Bypass Through User‑Controlled Critical Parameter flaw. @neo4j/graphql fails to enforce field‑level @authentication directives on root custom‑resolver fields when a type‑level @authentication is also declared on the same operation type. The library evaluates only the type‑level rule, discarding the stricter per‑field rule. A client that satisfies the coarse, type‑level requirement can invoke a field that requires a higher privilege, such as an admin‑role JWT claim, without having that privilege. This flaw is not the result of token forgery; a standard, non‑admin, correctly signed token is sufficient for exploitation.

The vulnerability affects the Neo4j GraphQL library. Versions from 5.2.0 up to <5.12.15 and <7.5.7 are impacted; Neo4j GraphQL 7.5.7+ or 5.12.15+ contain the fix. The v6 series is end‑of‑life and will not receive a patch.

Based on the description, it is inferred that the attack vector is remote access to the exposed GraphQL endpoint; an attacker with credentials that satisfy the type‑level @authentication may invoke the higher‑privilege field when the stricter rule is not evaluated. The CVSS score of 7.6 indicates a high privilege escalation risk. The EPSS score is missing and the vulnerability is not listed in the CISA KEV catalog, so there is no evidence of widespread exploitation yet.