What is 2026-133-AWS?

2026-133-AWS is a security advisory published by AWS Security Bulletins with High severity. CVE-2026-108096: Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

Which CVE IDs does 2026-133-AWS cover?

2026-133-AWS covers the following CVE IDs: CVE-2026-108096. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

2026-133-AWSHigh

CVE-2026-108096: Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

Vendor

AWS Security Bulletins

Published

October 9, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-108096 →

📋 Description

Bulletin ID: 2026-133-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/09/2026 11:00 AM PDT Description: AWS Amplify API Category is a CDK Construct library for defining GraphQL data models with authorization rules as AWS AppSync APIs. We identified CVE-2026-108096, where improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. Impacted versions:

@aws-amplify/graphql-index-transformer >=2.2.0,
@aws-amplify/graphql-api-construct >=1.4.0,
@aws-amplify/data-construct Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

🔗 References (1)

advisoryhttps://aws.amazon.com/security/security-bulletins/rss/2026-133-aws/