Public role privilege modification impacted for some Business Critical instances

Incident Report for Neo4j Aura

Postmortem

What happened

On June 27th, the new predefined roles feature*  for AuraDB customers inadvertently removed database Admin access from some Business Critical (BC) instances. As a temporary fix, the team disabled the feature for Business Critical instances. While the fix took place, it also replaced the database public RBAC role privileges which are available on Business Critical with enhanced public role privileges available on Free/Pro instances. System logic prevented customers from modifying the public role during that time.*https://neo4j.com/docs/aura/user-management/#_predefined_roles 

Neo4j restored the public role to its original limited permissions for all Virtual Dedicated Cloud instances on June 30, and for all Business Critical instances on July 1. 

How customers were affected

Customers were affected by this issue from June 27th to July 1st.  The issue impacted some Business-Critical (BC) instances and a small number of Virtual Dedicated Cloud (VDC) instances. All project admin users with affected instances received an email confirming the issue was resolved on July 1st. 

What we are doing now

Neo4j remains committed to providing reliable service and is implementing additional safeguards to prevent similar incidents in the future:

  • We have implemented safeguards in our system to prevent misconfigured role changes and better isolate feature toggles from production permission models
  • We are reviewing our internal release processes to improve testing and validation of role-based access control (RBAC) changes
  • We are implementing additional detection methods for misconfigured RBAC which will alert our operational teams
Posted Jul 15, 2025 - 14:51 UTC

Resolved

We have applied a fix and verified this is fully resolved.
Posted Jul 03, 2025 - 18:32 UTC

Update

We have identified the issue and a fix is being rolled out
Posted Jul 02, 2025 - 05:17 UTC

Identified

We have identified an issue where the PUBLIC role cannot be modified on certain Business Critical instances.
The public role is available to all database users, and contains a limited set of privileges outlined in our documentation: https://neo4j.com/docs/operations-manual/current/authentication-authorization/built-in-roles/#access-control-built-in-roles-public
Posted Jun 30, 2025 - 20:40 UTC
This incident affected: AuraDB Business Critical (*.databases.neo4j.io) (AuraDB Business Critical (*.databases.neo4j.io) on AWS, AuraDB Business Critical (*.databases.neo4j.io) on Azure, AuraDB Business Critical (*.databases.neo4j.io) on GCP).