CVE-2026-5423: graphql 7.0.0 to before 7.5.6, 5.0.0 to before 5.12.14, 6.0.0 through 6.6.4

Affected technology

graphql · 7.0.0 to before 7.5.6, 5.0.0 to before 5.12.14, 6.0.0 through 6.6.4
neo4j

Description’s affected range: versions prior to 7.5.6 fail to verify the authenticity of a client-supplied

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

A fully unauthenticated attacker can receive subscription events that should be restricted to specific authenticated roles/users. Source advisory’s CVSS 4.0 assessment (base score 8.2/10) rates confidentiality impact as high; integrity and availability impact as none.