All vulnerabilities
CVE-2026-108096GHSA-69c4-mvf5-5xm3

aws-amplify/graphql-index-transformer: Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

AWS aws-amplify/graphql-index-transformerContainers & cloud
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.1.2Also 1.21.4, 1.17.4CVE List
Published9 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

  • 3.1.2aws-amplify/graphql-index-transformerCVE List
  • 1.21.4aws-amplify/graphql-api-constructCVE List
  • 1.17.4aws-amplify/data-constructCVE List
  • 3.1.2@aws-amplify/graphql-index-transformer, npmGitHubnpm install @aws-amplify/graphql-index-transformer@3.1.2
  • 1.21.4@aws-amplify/graphql-api-construct, npmGitHubnpm install @aws-amplify/graphql-api-construct@1.21.4
  • 1.17.4@aws-amplify/data-construct, npmGitHubnpm install @aws-amplify/data-construct@1.17.4

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.

This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4 and @aws-amplify/graphql-api-construct 1.21.4 https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.

Text from GitHub Advisory Database

Affected versions 6

  • aws-amplify/graphql-index-transformeraffected: 2.2.0 before 3.1.2CVE List
  • aws-amplify/graphql-api-constructaffected: 1.4.0 before 1.21.4CVE List
  • aws-amplify/data-constructaffected: all versions before 1.17.4CVE List
  • @aws-amplify/graphql-index-transformer, npm<3.1.2GitHub
  • @aws-amplify/graphql-api-construct, npm<1.21.4GitHub
  • @aws-amplify/data-construct, npm<1.17.4GitHub

References 5