Description
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4 and @aws-amplify/graphql-api-construct 1.21.4 https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
AWS aws-amplify/graphql-index-transformer
Default version status: unaffected
2.2.0 to < 3.1.2affected
AWS aws-amplify/graphql-api-construct
Default version status: unaffected
1.4.0 to < 1.21.4affected
AWS aws-amplify/data-construct
Default version status: unaffected
0 to < 1.17.4affected
References
- https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 ↗
- https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ↗
- https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4 ↗
- https://aws.amazon.com/security/security-bulletins/2026-133-aws/ ↗
- https://github.com/aws-amplify/amplify-category-api/security/advisories/GHSA-69c4-mvf5-5xm3 ↗