rewindex

RewindexCVEsAmazon Web Services

CVE-2026-108096: Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

Medium · CVSS 6.5 (CVSS 3.1)EPSS 0.30%, 22th percentilePublished Updated Assigner: AMZN

Description

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4 and @aws-amplify/graphql-api-construct 1.21.4 https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · CWE-639

Tracked companies

Amazon Web Services

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

AWS: aws-amplify/data-constructAWS: aws-amplify/graphql-api-constructAWS: aws-amplify/graphql-index-transformer

References

All CVEsMarkdownJSON