AWS Amplify API Authorization Flaw Allows Cross-User Data Access

AWS has issued a security bulletin on October 9, 2026, regarding an authorization vulnerability in its Amplify API Category. The issue, identified as CVE-2026-108096, allows authenticated remote users to potentially read records owned by other users within the same application by submitting crafted queries.

The vulnerability stems from improper authorization logic in the query resolvers generated by the @aws-amplify/graphql-index-transformer package. AWS Amplify API Category is a CDK Construct library designed for defining GraphQL data models with authorization rules as AWS AppSync APIs. According to the official advisory, the flaw enables data leakage across user boundaries, compromising the integrity of access controls intended to isolate user-specific data.

Technical Context and Scope

The security bulletin, designated as 2026-133-AWS, classifies the issue as "Important," indicating that it requires attention from developers and security professionals. The core problem lies in how the transformer package generates resolvers for SQL-backed models. When these resolvers are improperly configured or generated, they fail to enforce strict authorization checks, allowing a remote user who is already authenticated to the application to bypass intended restrictions.

This is not a total system compromise but a specific breakdown in row-level or user-level security. The attacker must already have authentication credentials for the application. Once authenticated, they can exploit the flawed resolver logic to query and retrieve data that belongs to other users, rather than just their own. This type of vulnerability is common in GraphQL APIs where complex authorization rules are mapped to underlying database queries.

Affected Components and Versions

The vulnerability impacts specific versions of several AWS Amplify packages. Developers using the following versions are considered at risk:

• @aws-amplify/graphql-index-transformer versions 2.2.0 up to, but not including, 3.1.2.
• @aws-amplify/graphql-api-construct versions 1.4.0 up to, but not including, 1.21.4.
• @aws-amplify/data-construct versions prior to 1.17.4.

Organizations relying on these specific CDK constructs to build their AWS AppSync APIs should verify their current dependency versions immediately. The bulletin directs users to refer to the associated article for the most up-to-date and complete information, suggesting that remediation details or patched versions may be available through those channels.

What should you do?

Security teams should audit their applications for the use of the affected AWS Amplify packages. If the vulnerable versions are present, teams should review the AWS advisory for remediation steps, which likely involve updating to the latest non-vulnerable versions. Until updates are applied, organizations should monitor their AppSync APIs for unusual query patterns that might indicate an attempt to access unauthorized data.