PT-2026-24715 · Neo4J · Neo4J Enterprise Edition

Published 2026-03-11 · Updated 2026-05-14 · CVE-2026-1497

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Neo4j Enterprise edition versions prior to 2026.02 Neo4j Enterprise edition versions prior to 5.26.22

Description An incorrect resolution of namespaces in composite databases in Neo4j Enterprise edition can lead to a scenario where an administrator unintentionally grants access to local databases or remote aliases. Specifically, when an administrator attempts to grant a user access to a remote database constituent using the format 'namespace.name', access is inadvertently granted to any local database or remote alias named 'name'. If a database or alias with that name does not exist at the time the command is executed, the privileges will be applied if it is created in the future.

Recommendations Update Neo4j Enterprise edition to version 2026.02 or later. Update Neo4j Enterprise edition to version 5.26.22 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-NEO4J-2026-1497

CVE-2026-1497

Affected Products

Neo4J Enterprise Edition

References · 6

• https://neo4j.com/security/CVE-2026-1497 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-neo4j-2026-1497 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1497 · Security Note
• https://t.me/cveNotify/163340 · Telegram Post
• https://twitter.com/CVEnew/status/2032998324995858734 · Twitter Post
• https://twitter.com/infoflowcloud/status/2032999157531574601 · Twitter Post