@neo4j/graphql permits top‑level fields annotated with @cypher to be invoked without respecting @authentication directives that are applied at the schema or type level. When an attacker calls such a field, the Cypher statement runs under the GraphQL service account, giving the attacker the same database access that the service account possesses. This allows both reading and modifying data that would normally be protected by the authentication rules. The weakness is a lack of enforcement of authentication, identified as CWE‑306.

Affected are installations of Neo4j using the @neo4j/graphql package at versions up to and including 7.6.3. Owners of GraphQL APIs that rely on schema‑level or type‑level @authentication to secure top‑level @cypher fields should confirm they are running at least version 7.6.4, where the enforcement has been corrected.

The CVSS score of 9.3 indicates a high severity vulnerability with both confidentiality and integrity impacts. The EPSS score is not available, so the likelihood of exploitation is uncertain, but the lack of authentication enforcement makes it trivially exploitable by any caller of the GraphQL endpoint. The vulnerability is not listed in the CISA KEV catalog, but the existence of a public advisory and the critical nature of the flaw mean that it should be treated as a high‑risk exposure. Attackers can target any exposed top‑level @cypher field at the GraphQL service without needing prior authentication, enabling data theft or modification.