CVE-2026-108096
Beschrijving NL
Onjuiste autorisatie in de queryresolvers gegenereerd door @ aws-amplify/graphql-index-transformator in AWS Amplify API-categorie vóór 3.1.2 kan een geverifieerde externe gebruiker in staat stellen om records te lezen die eigendom zijn van andere gebruikers van dezelfde applicatie via bewerkte query's. Dit probleem is verholpen in @ aws-amplify/graphql-index-transformator 3.1.2 https://www.npmjs.com/package/ @ aws-amplify/graphql-index-transformator/v/3.1.2 (opgenomen in @ aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package/ @ aws-amplify/data-construct/v/1.17.4 en @ aws-amplify/graphql-api-construct 1.21.4 https://www.npmjs.com/package/ @ aws-amplify/graphql-api-construct/v/1.21.4 ). We raden aan om te upgraden naar de nieuwste versie, zodat elke gevorkte of afgeleide code wordt gepatcht om de nieuwe fixes op te nemen en vervolgens hun backend opnieuw te implementeren.
Origineel (Engels) tonen
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.
This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4 and @aws-amplify/graphql-api-construct 1.21.4 https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.