PT-2026-109295 · Aws · Aws-Amplify/Graphql-Index-Transformer
CVE-2026-108096
·
Published
2026-10-09
·
Updated
2026-10-12
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
@aws-amplify/graphql-index-transformer versions prior to 3.1.2
Description
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category may allow an authenticated remote user to read records owned by other users of the same application by using crafted queries.
Recommendations
Update @aws-amplify/graphql-index-transformer to version 3.1.2 or later, ensure any forked or derivative code is patched, and redeploy the backend.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Aws-Amplify/Graphql-Index-Transformer