Logo
Retour à la veille

CVE-2026-108096

Publié : 9 octobre 2026
Modifié : 9 octobre 2026
Lien officiel NVD
Score CVSS
6.5
MEDIUM

Description détaillée

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4 and @aws-amplify/graphql-api-construct 1.21.4 https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Références et Patchs

https://aws.amazon.com/security/security-bulletins/2026-133-aws/https://github.com/aws-amplify/amplify-category-api/security/advisories/GHSA-69c4-mvf5-5xm3https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2

Dernières Vulnérabilités

CVE-2026-78835

Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.

VOIR DÉTAILS

CVE-2026-75353

OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remtoe attacker to cause a denial of service

VOIR DÉTAILS

CVE-2026-75352

OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service

VOIR DÉTAILS