{"answers":{"affected":"2 open source packages ship an affected version, including neotoma.","exploited":"There is no known exploitation of GHSA-wrr4-782v-jhwh in the wild and no public exploit code.","fix":"Upgrade neotoma to 0.14.0 or later.","what":"GHSA-wrr4-782v-jhwh is a missing authorization vulnerability in neotoma, published on 25 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-wrr4-782v-jhwh and fix it if it is affected.\n\nWhat it is: GHSA-wrr4-782v-jhwh is a missing authorization vulnerability in neotoma, published on 25 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-wrr4-782v-jhwh in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- neotoma (npm): affected from 0.13.0; fixed in 0.14.0\n- neotoma (npm): affected from 0.13.0; fixed in 0.14.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-wrr4-782v-jhwh/ (Markdown: https://insights.sbomify.com/GHSA-wrr4-782v-jhwh/index.md)","id":"GHSA-wrr4-782v-jhwh","markdown":"https://insights.sbomify.com/GHSA-wrr4-782v-jhwh/index.md","name":"GHSA-wrr4-782v-jhwh","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Neotoma graph service","requires_auth":"low_privilege","summary":"Authenticated users can access other users' relationship data due to missing tenant isolation filters in query endpoints.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\nThe `/list_relationships` and `/retrieve_graph_neighborhood` endpoints call `getAuthenticatedUserId` (confirming a valid session exists) but do not pass the resolved user ID into the Supabase query as an `.eq(\"user_id\", userId)` filter. As a result, queries return rows from all users rather than scoping to the authenticated caller's data.\n\n## Affected code\n\n**`/list_relationships`** (`src/actions.ts`):\n- Calls `getAuthenticatedUserId` but does not apply `.eq(\"user_id\", userId)` to the relationships query\n- Uses `.or()` string interpolation for entity ID matching without input validation\n\n**`/retrieve_graph_neighborhood`** (`src/actions.ts`):\n- Same pattern: auth resolved, user ID not applied to query filter\n\n## Affected versions\n\nv0.13.0\n\n## Prerequisites\n\n1. A valid authentication token for the Neotoma instance (attacker must have a legitimate account on the same instance)\n2. A known entity ID belonging to another user (~96 bits of entropy — brute-force not practical)\n\nAn unauthenticated caller is rejected at the auth middleware layer. The gap requires a second user account on the instance.\n\n## Impact\n\nAn authenticated user with a known cross-user entity ID can retrieve relationship edges and graph neighborhood data belonging to another user. No write capability is exposed.\n\n## Severity\n\nLow under current conditions — no multi-tenant deployments exist. Escalates to Medium the moment two or more user accounts share an instance.\n\n## Remediation\n\n1. Add `.eq(\"user_id\", userId)` to all Supabase queries in both handlers\n2. Validate entity ID inputs with `isNeotomaEntityId` before query construction\n3. Replace `.or()` string interpolation with separate scoped `.eq()` calls\n\nFix tracked in #365 (list_relationships) and #366 (retrieve_graph_neighborhood). Gate gap tracked in #372.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"neotoma has tenant isolation gap in relationship query endpoints","id":"GHSA-wrr4-782v-jhwh","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["0.14.0"],"introduced":["0.13.0"],"last_affected":[],"package":"neotoma","purl":null,"source":"GHSA-wrr4-782v-jhwh"},{"ecosystem":"npm","fixed":["0.14.0"],"introduced":["0.13.0"],"last_affected":[],"package":"neotoma","purl":"pkg:npm/neotoma","source":"GHSA-wrr4-782v-jhwh"}],"products":null,"published":"2026-06-25","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Authenticated users can access other users' relationship data due to missing tenant isolation filters in query endpoints.","url":"https://insights.sbomify.com/GHSA-wrr4-782v-jhwh/"}