VulnSocial

CVE-2026-108096

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4 and @aws-amplify/graphql-api-construct 1.21.4 https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-10: 110-10
Referenced assets1 URL
Full discourse1 post
  • Xcademia@xcademialtd

    🚨 An AWS Amplify API flaw could expose other users’ data. 🔓☁️ CVE-2026-108096 highlights a serious risk: API vulnerabilities can expose data beyond the user who should have access. 🔓 Cross-user data exposure ☁️ AWS Amplify API affected ⚠️ Access control at risk 🛡️ Data isolation matters One broken access control can turn private data into someone else’s target. 👉 Read the full breakdown of CVE-2026-108096 and the exposure risk 👇 https://www.xcademia.com/news/aws-amplify-api-vulnerability-could-expose-other-users-data-cve-2026-108096 #AWS #CyberSecurity #APIsecurity #DataPrivacy #CVE #CloudSecurity #AppSec #InfoSec #Xcademia

    0001030
    22 followersView on X

Explore more

Back to dashboard