Vulnerabilities

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might…

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4 and @aws-amplify/graphql-api-construct 1.21.4 https://www.np

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Amazon Web Services

Product

AWS services

CVSS

6.5

Fix

available

Exposure class

Cloud platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-108096 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 25
   AWS bulletin AWS 22d ago

   CVE-2026-108096: Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

   CVE-2026-108096 Amazon Web Services