CVE-2026-108096: CWE-639 Authorization bypass through User-Controlled key in AWS aws-amplify/graphql-index-transformer

The vulnerability CVE-2026-108096 arises from improper authorization checks in the query resolvers generated by the @aws-amplify/graphql-index-transformer package in AWS Amplify API Category versions prior to 3.1.2. Authenticated users could exploit this flaw to access data records owned by other users of the same application by submitting specially crafted queries. This issue is tracked as CWE-639 (Authorization Bypass Through User-Controlled Key). The vendor has addressed the vulnerability in version 3.1.2 of @aws-amplify/graphql-index-transformer, which is included in @aws-amplify/data-construct 1.17.4 and @aws-amplify/graphql-api-construct 1.21.4. The advisory recommends upgrading to these fixed versions and ensuring any derivative or forked code incorporates the fixes before redeployment.

An authenticated remote user can bypass authorization controls to read data records owned by other users within the same application. This results in a confidentiality breach but does not affect data integrity or availability. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

A fix is available. Users should upgrade to @aws-amplify/graphql-index-transformer version 3.1.2 or later. Additionally, upgrade related packages @aws-amplify/data-construct to 1.17.4 or later and @aws-amplify/graphql-api-construct to 1.21.4 or later. Ensure that any forked or derivative codebases are patched with these fixes and redeploy the backend to apply the remediation. Since this is a cloud service component, the vendor manages remediation for the hosted service, but customers must update their local or forked code accordingly.