Bulletin ID: 2026-133-AWSScope: AWSContent Type: Important (requires attention)Publication Date: 10/09/2026 11:00 AM PDTDescription:AWS Amplify API Category is a CDK Construct library for defining GraphQL data models with authorization rules as AWS AppSync APIs. We identified CVE-2026-108096, where improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.Impacted versions:- @aws-amplify/graphql-index-transformer >=2.2.0, <3.1.2;- @aws-amplify/graphql-api-construct >=1.4.0, <1.21.4;- @aws-amplify/data-construct <1.17.4Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.