This vulnerability arises from CWE-915: Improperly controlled modification of dynamically-determined object attributes in AWS Ops Wheel's Cognito User Pool configuration. Remote authenticated users can exploit this by sending a crafted UpdateUserAttributes API call that sets the custom:deployment_admin attribute, escalating their privileges to deployment admin and gaining management capabilities over Cognito user accounts. The issue affects AWS Ops Wheel before PR #165. AWS, as the cloud service provider, manages remediation and has issued a fix requiring users to redeploy updated code and patch derivatives.

Successful exploitation allows remote authenticated users to escalate privileges to deployment admin level within AWS Ops Wheel, granting them the ability to manage Cognito user accounts. This can lead to full compromise of user account management and potentially broader administrative control within the deployment environment. The CVSS 3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

A patch is available and remediation is managed by AWS as this is a cloud-hosted service. Users should redeploy from the updated AWS Ops Wheel repository incorporating the fix from PR #165. Additionally, any forked or derivative codebases must be patched to include these updates. Refer to the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-018-aws/ for detailed remediation instructions.