Neo4j Enterprise Edition Information Disclosure Vulnerability

A vulnerability allowing information disclosure exists in Neo4j Enterprise Edition versions prior to 2025.11.2 and 5.26.17. This issue can be exploited by an attacker with legitimate access to the database who lacks read access to a specific property. The vulnerability enables the attacker to infer the property's value by enumerating possible values and observing the error messages generated when attempting to set the property. This could lead to unauthorized knowledge of sensitive data.

Impact

Exploitation of this vulnerability could result in unauthorized information disclosure, allowing an attacker to infer property values they do not have permission to read.

Remediation

Users are advised to upgrade to Neo4j Enterprise Edition versions 2025.11.2 or 5.26.17 and above, where this vulnerability has been fixed. The issue is not applicable to Neo4j AuraDB, the fully managed cloud service.