CVE-2026-108096— Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
Quick assessment
Affected
AWS aws-amplify/graphql-index-transformer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
AWS Amplify API 类别中的 在 3.1.2 版本之前生成的查询解析器中存在不正确的授权问题，可能导致经过身份验证的远程用户通过精心构造的查询读取同一应用程序中其他用户的记录。 此问题已在 3.1.2 版本中得到修复，相关信息可参见：https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2（该版本包含在 1.17.4 和 1.21.4 中：https://www.npmjs.com/package/@aws-
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| AWS | aws-amplify/data-construct | < 1.17.4 |
affected |
| AWS | aws-amplify/graphql-api-construct | 1.4.0≤ 1.21.4 |
affected |
| AWS | aws-amplify/graphql-index-transformer | 2.2.0< 3.1.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108096
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
Source: CVE Program / CVE List V5
Vulnerability Description
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.
This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4 and @aws-amplify/graphql-api-construct 1.21.4 https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AWS | aws-amplify/graphql-index-transformer | 2.2.0 ~ 3.1.2 | - |
|
| AWS | aws-amplify/graphql-api-construct | 1.4.0 ~ 1.21.4 | - |
|
| AWS | aws-amplify/data-construct | 0 ~ 1.17.4 | - |
|
II. Public POCs for CVE-2026-108096
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108096
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-108096 (2)
IV. Related Vulnerabilities
Same vendor: AWS
-
CVE-2026-107783
Insertion of sensitive information into log file in AWS Tool -
CVE-2026-107608
Improper link resolution in asset bundling output handling i -
CVE-2026-107322
OS command injection in Amazon Agent Plugins for AWS databas -
CVE-2026-107332
Insecure Default File Permissions on Cached Credentials in A -
CVE-2026-107352
Missing authorization checks in Amazon Athena engine version
Same weakness: CWE-639
-
CVE-2026-107856
CiviForm: Trusted-Intermediary IDOR discloses any citizen's -
CVE-2026-107854
Jexactyl: Free-billing order endpoint renews and unsuspends -
CVE-2026-107850
Contao: Improper access control in the preview links module -
CVE-2026-108110
MOVO through 0.2.3 Authorization Bypass via Document Endpoin -
CVE-2026-78026
Dell SCG <5.34.00.16 权限提升漏洞
V. Comments for CVE-2026-108096
No comments yet