Live › vulnerability › GHSA-69c4-mvf5-5xm3
Go to dashboardQuery resolvers generated for SQL-backed models in the Amplify API Category skip proper authorization checks, so a signed-in user can craft GraphQL queries to read records owned by other users of the same application. The fix is in the updated index transformer and the constructs that bundle it, and no workaround is documented.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:28 UTC. All times on this page are UTC.
Teams that define GraphQL data models with Amplify's CDK constructs and use SQL-backed models whose query resolvers rely on owner-based authorization. Backends that do not use these packages, or that have already moved to the fixed versions, are not affected.
No product ranges from the sources yet.
@aws-amplify/graphql-index-transformer version in package.json and lockfile; affected if below 3.1.2@aws-amplify/graphql-api-construct (affected below 1.21.4) and @aws-amplify/data-construct (affected below 1.17.4)@aws-amplify/graphql-index-transformer to 3.1.2@aws-amplify/data-construct to 1.17.4 or @aws-amplify/graphql-api-construct to 1.21.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-108096: Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
Bulletin ID: 2026-133-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/09/2026 11:00 AM PDT
Description:
AWS Amplify API Category is a CDK Construct library for defining GraphQL data models with authorization rules as AWS AppSync APIs. We identified CVE-2026-108096, where improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.
Impacted versions:
Resolution:
This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 (included in @aws-amplify/data-construct 1.17.4 and @aws-amplify/graphql-api-construct 1.21.4). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.
Workarounds:
No workarounds are available.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-69c4-mvf5-5xm3")