{"cve":"CVE-2026-108096","nvd":{"published":"2026-10-09T18:17:06.410","modified":"2026-10-20T19:17:24.043","status":"Awaiting Analysis","description":"Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.\n\n\n\nThis issue has been addressed in @aws-amplify/graphql-index-transformer  3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2  (included in @aws-amplify/data-construct  1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4  and @aws-amplify/graphql-api-construct  1.21.4 https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":7.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-639"],"references":["https://aws.amazon.com/security/security-bulletins/2026-133-aws/","https://github.com/aws-amplify/amplify-category-api/security/advisories/GHSA-69c4-mvf5-5xm3","https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4","https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4","https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2"],"products":[],"source":"nvd","synced_at":"2026-10-21T03:56:58.798400159+00:00"},"epss":{"cve":"CVE-2026-108096","score":0.00299,"percentile":0.22432,"date":"2026-10-26"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}