The vulnerability arises from a logical flaw in the @authorization filters of @neo4j/graphql where the "none" quantifier is mistakenly interpreted as "some" when translating to Cypher. Consequently, a rule that intends to deny access to all matching related records actually permits those same records, allowing an authenticated user to read or modify data they should not access. This flaw can expose sensitive information through queries and enable unauthorized creation or deletion of records via mutations. The weakness is a Predicate Logic Error (CWE-863).

The affected product is Neo4j's @neo4j/graphql JavaScript library, specifically versions 7.0.0 through 7.6.3 inclusive. The impact applies only when the library is used to apply @authorization filters on relationships or connections in GraphQL schemas.

The CVSS score of 8.6 indicates high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently known to be actively exploited. The likely attack vector is through normal GraphQL operations—queries or mutations—executed by an authenticated user. If an attacker can construct or modify authorization rules that include the "none" quantifier, they can bypass intended access controls to read or alter protected data. The logical inversion effectively creates a local privilege escalation scenario within the GraphQL API. The risk is that any application that relies on @neo4j/graphql for access control is susceptible to this flaw until the library is updated or the misuse of the quantifier is corrected.