CVE-2021-34802: Improper Privilege Management in Neo4j Graph Database
Summary
CVE-2021-34802: Improper Privilege Management in Neo4j Graph Database. Affects org.neo4j:neo4j-kernel versions >= 4.2.0, < 4.2.8. Fixed in 4.2.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Neo4j Graph Database is a powerful and popular database management system that utilizes graph structures to store and process data. It provides a flexible and efficient way to model and query complex relationships between entities. The Neo4j Graph Database is widely used in various domains, including social networks, recommendation systems, and fraud detection. However, a vulnerability has been identified in Neo4j Graph Database 4.2 that could lead to improper privilege management.
Vulnerability Detail
The vulnerability in Neo4j Graph Database 4.2 arises from a failure in resetting the security context during certain transaction actions. This flaw could be exploited by authenticated users to execute commands with elevated privileges. An attacker with a valid user account could abuse this vulnerability to perform unauthorized actions, potentially compromising the confidentiality, integrity, and availability of the database and the data it stores. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 2026.10.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.2.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of Neo4j Graph Database.
Conclusion
The vulnerability in Neo4j Graph Database 4.2 allows authenticated users to execute commands with elevated privileges, posing a significant risk to the security and integrity of the database. It is crucial to upgrade to the latest version of Neo4j Graph Database (4.2.8 or later) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.neo4j:neo4j-kernel →
FAQ
Neo4j Graph Database is a powerful database management system that utilizes graph structures to store and process data. It is widely used in various domains for modeling and querying complex relationships.
The vulnerability allows authenticated users to execute commands with elevated privileges, potentially compromising the security and integrity of the database and the data it stores.
To fix this vulnerability, it is recommended to upgrade to Neo4j Graph Database version 4.2.8 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the latest version of Neo4j Graph Database.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
