Live › vulnerability › CVE-2026-108096
Go to dashboardQuery resolvers generated by the Amplify GraphQL index transformer fail to check authorization properly for SQL-backed models. An authenticated user can read records owned by other users of the same application through crafted queries.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:28 UTC, 1h before NVD. All times on this page are UTC.
Teams whose AWS Amplify backend defines GraphQL data models with authorization rules and uses the affected constructs or transformer versions. The flaw lets an authenticated user read records that belong to other users of the same application. Applications on versions outside the listed ranges, or that do not use these packages, are not affected.
No product ranges from the sources yet.
@aws-amplify/graphql-index-transformer, @aws-amplify/graphql-api-construct and @aws-amplify/data-construct in the backend's lockfile, e.g. npm ls @aws-amplify/graphql-index-transformer@aws-amplify/graphql-index-transformer to 3.1.2 or later@aws-amplify/graphql-api-construct to 1.21.4 or later@aws-amplify/data-construct to 1.17.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-108096: Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
Bulletin ID: 2026-133-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/09/2026 11:00 AM PDT
Description:
AWS Amplify API Category is a CDK Construct library for defining GraphQL data models with authorization rules as AWS AppSync APIs. We identified CVE-2026-108096, where improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.
Impacted versions:
Resolution:
This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 (included in @aws-amplify/data-construct 1.17.4 and @aws-amplify/graphql-api-construct 1.21.4). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.
Workarounds:
No workarounds are available.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-108096")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.