AWS Amplify API Category allows an authenticated user to construct queries that bypass row‑level isolation in SQL‑backed models, enabling the reading of records belonging to other users. The flaw is an improper authority check (CWE‑639) that directly compromises confidentiality of user data without affecting integrity or availability. With a CVSS base score of 7.1 the vulnerability is considered a moderate‑to‑high risk to applications that rely on Amplify’s autogenerated query resolvers.

The issue appears in several Amplify modules: @aws‑amplify/graphql‑index‑transformer, @aws‑amplify/data‑construct, and @aws‑amplify/graphql‑api‑construct. Specifically, any deployment of graphql‑index‑transformer earlier than version 3.1.2, data‑construct earlier than 1.17.4, or graphql‑api‑construct earlier than 1.21.4 is susceptible. These libraries are part of the core Amplify API Category that facilitates GraphQL endpoints backed by relational databases.

Although no EPSS score is publicly available, the moderate CVSS rating indicates a tangible likelihood that attackers could exploit the issue. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation in the public domain yet. Attackers would need valid credentials within the same Amplify application; using these credentials they can issue crafted GraphQL queries to retrieve data that should belong only to other users. The path to exploitation is remote, leveraging the normal API endpoint, and requires no additional privileged access beyond normal authentication.