CVE-2026-1524

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>neo4j</name>
	<range><lt>5.26.22</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An edgecase in SSO implementation in Neo4j Enterprise edition versions
	prior to version 2026.02 can lead to unauthorised access under the
	following conditions:


If a neo4j admin configures two or more OIDC
	providers AND configures one or more of them to be an authorization
	provider AND configures one or more of them to be authentication-only,
	then those that are authentication-only will also provide
	authorization. This edgecase becomes a security problem only if the
	authentication-only provider contains groups which have higher
	privileges than provided by the intended (configured) authorization
	provider.  

When using multiple plugins for authentication and
	authorisation, prior to the fix the issue could lead to a plugin
	configured to provide only authentication or authorisation
	capabilities erroneously providing both capabilities. 

We recommend
	upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-1524</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-1524</url>
    </references>
    <dates>
      <discovery>2026-03-11</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>