Neo4j Cypher component mishandles IMMUTABLE privileges

MEDIUM 6.5CVE-2024-34517 · BIT-neo4j-2024-34517 · BIT-neo4j-enterprise-2024-34517 · Published 07/05/2024 · updated 28/08/2026

In short

CVE-2024-34517 is a MEDIUM (CVSS 6.5) vulnerability affecting org.neo4j:neo4j-cypher, neo4j (neo4j).
Chance of exploitation in the next 30 days (EPSS): 0.63%, higher than 50.2% of all vulnerabilities.
Fix: update to 5.19.0 or later.

Package	Affected versions	Patched versions
org.neo4j:neo4j-cypher Maven	`≥ 5.0.0, < 5.19.0`	`5.19.0`
neo4j neo4j	`≥ 5.0.0, < 5.19.0`	`5.19.0`

The Cypher component in Neo4j between v.5.0.0 and v.5.19.0 mishandles IMMUTABLE.

NVD description

The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.