The vulnerability allows a user‑controlled authorization key within the optional Amazon Q Business Lambda hook sample to be bypassed, enabling an authenticated remote user to read arbitrary Amazon S3 objects in the deploying AWS account. This is an instance of improper access control that can compromise the confidentiality of data stored in S3 buckets. The description states that for users who have not deployed the optional sample hook, the issue does not apply, so only those who have used the sample are affected. The attack does not involve remote code execution or denial of service but presents a significant risk to data exposure.

Customers using QnABot on AWS versions 7.0.0 through 7.4.5 who have manually deployed the Amazon Q Business Lambda hook sample are affected. The vendor for these assets is Amazon (aws:qnabot-on-aws). If the sample hook stack has not been deployed, the system remains unaffected. The impacted environment involves AWS Lambda, Amazon S3, and the QnABot application stack.

The CVSS score of 7.1 indicates high severity, with an impact on confidentiality and a moderate to high likelihood of exploitation for authenticated users. Since the EPSS score is unavailable, the exploitation probability cannot be precisely quantified, but the fact that it requires an authenticated user mitigates against widespread anonymous attacks. The vulnerability is not included in the CISA KEV catalog, suggesting no known large‑scale exploitation to date. The likely attack vector is a legitimate user exploiting the Lambda hook’s key validation flaw to read S3 objects. Given the necessity of the optional sample, the risk is confined to those who have deployed it and may be mitigated by following the official patch steps.