CVE Watch20 de out. de 2026

CVE-2026-108096

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 m

CVSS

6.5

Média

EPSS

0.3%

p23

KEV

—

Exploit Today

0-100

Publicado: 9 de out. de 2026 · Última mod.: 20 de out. de 2026 · CWE-639

EPSS · 30d

0.3%EPSS · 30 dias0.3%

2026-10-102026-11-05

Descrição técnica

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4 and @aws-amplify/graphql-api-construct 1.21.4 https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-891016.5 MÉD

—

———The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.6h CVE-2026-1233295.4 MÉD

—

———In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions7h CVE-2026-1232914.3 MÉD

—

———In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook7h CVE-2026-1204746.5 MÉD

—

———undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.8h CVE-2026-887998.8 ALT

—

———The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.6h CVE-2026-1181872.7 BAI

—

———The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.6h