CVE-2026-1497

neo4j-enterprise: Incorrect Authorization (CVE-2026-1497)

Affected

bitnami/neo4j-enterprise 2025.1.0..*

Description

Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database or alias doesn't exist when the command is run, the privileges will apply if it's created in the future.

Source: OSV (Open Source Vulnerabilities)cvelistv5 NVD (NIST)CVE.org (MITRE)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

bitnamineo4j-enterprise

2025.1.0

Metrics

XIEM Effective CVSS

7.2

Source: nvd-v3

EPSS percentile

14.4 %

Elevated — this CVE ranks above at least 10% of all CVEs scored today.

KEV status

—

Show all metrics

Severity

high

64.89

no public PoC known

7.2

2.0

0.2 %

Low — model estimates < 1% exploitation likelihood.

Published

2026-08-27 07:44 UTC

CWE

CWE-863

Weakness classes (CWE)

CWE-863Class
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

Modified Analysis2026-08-28 16:08 UTC· nvd@nist.gov
- CPE Configuration: OR *cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:* versions up to (excluding) 5.26.22 *cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:* versions from (including) 2025.01.0 up to (excluding) 2026.02 → OR *cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:* versions up to (excluding) 5.26.22 *cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:* versions from (including) 2025.01.0 up to (excluding) 2026.02.0