Neo4j Enterprise Edition Namespace Resolution Vulnerability in Composite Databases

A vulnerability exists in Neo4j Enterprise Edition versions prior to 2026.02 and 5.26.22, related to incorrect namespace resolution in composite databases. This issue allows an admin to unintentionally grant a user access to local databases or remote aliases with the same name, instead of the intended remote database constituent. If the specified database or alias does not exist at the time of the command, the granted privileges will apply to any future creation of such a database or alias.

Impact

Exploitation of this vulnerability could lead to unauthorized access to databases or aliases, allowing users to interact with data they should not have access to.