CVE-2026-1524

{"id": "CVE-2026-1524", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 2.1, "Automatable": "NO", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-11T17:16:54.477", "references": [{"url": "https://neo4j.com/security/CVE-2026-1524", "tags": ["Vendor Advisory"], "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:\n\n\nIf a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if\u00a0the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider. \n\nWhen using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.\u00a0\n\nWe recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed."}, {"lang": "es", "value": "Un caso l\u00edmite en la implementaci\u00f3n de SSO en versiones de Neo4j Enterprise edition anteriores a la versi\u00f3n 2026.02 puede llevar a un acceso no autorizado bajo las siguientes condiciones:\n\nSi un administrador de Neo4j configura dos o m\u00e1s proveedores OIDC Y configura uno o m\u00e1s de ellos como proveedor de autorizaci\u00f3n Y configura uno o m\u00e1s de ellos para ser solo de autenticaci\u00f3n, entonces aquellos que son solo de autenticaci\u00f3n tambi\u00e9n proporcionar\u00e1n autorizaci\u00f3n. Este caso l\u00edmite se convierte en un problema de seguridad solo si el proveedor solo de autenticaci\u00f3n contiene grupos que tienen privilegios m\u00e1s altos que los proporcionados por el proveedor de autorizaci\u00f3n previsto (configurado).\n\nAl usar m\u00faltiples plugins para autenticaci\u00f3n y autorizaci\u00f3n, antes de la correcci\u00f3n, el problema podr\u00eda llevar a que un plugin configurado para proporcionar solo capacidades de autenticaci\u00f3n o autorizaci\u00f3n proporcionara err\u00f3neamente ambas capacidades.\n\nRecomendamos actualizar a las versiones 2026.02 (o 5.26.22) donde el problema est\u00e1 corregido."}], "lastModified": "2026-05-22T13:23:14.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "2F0CBF4C-6B09-4AF9-9A75-C079D06F8791", "versionEndExcluding": "5.26.22"}, {"criteria": "cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "E519E44D-D563-4A86-B4DB-9CBC391A28CF", "versionEndExcluding": "2026.02", "versionStartIncluding": "2025.01.0"}], "operator": "OR"}]}], "sourceIdentifier": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}