PT-2026-24726 · Neo4J · Neo4J Enterprise Edition

Published 2026-03-11 · Updated 2026-05-29 · CVE-2026-1471

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L/U:Clear

Name of the Vulnerable Software and Affected Versions Neo4j Enterprise edition versions prior to 2026.01.4

Description Excessive caching of authentication context in Neo4j Enterprise edition allows authenticated users to inherit the context of the first user who authenticated after a restart. This issue is limited to specific, non-default configurations of Single Sign-On (SSO) utilizing the UserInfo endpoint.

Recommendations Upgrade to version 2026.01.4 or 5.26.22 to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-NEO4J-2026-1471

CVE-2026-1471

Affected Products

Neo4J Enterprise Edition

References · 6

• https://neo4j.com/security/CVE-2026-1471 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1471 · Security Note
• https://osv.dev/vulnerability/BIT-neo4j-2026-1471 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2032411950051623416 · Twitter Post
• https://twitter.com/CVEnew/status/2032410995151589476 · Twitter Post
• https://t.me/cveNotify/164558 · Telegram Post