The vulnerability is an incorrect privilege assignment in the AWS CICD-toolchain-for-serverless-applications IAM policy for versions 1.0.7 through 1.0.10. It allows a remote authenticated user who has push access to the source repository to elevate privileges and obtain access or modify resources that are outside the intended application stack. This weakness is a classic example of an improper privilege assignment (CWE‑266), leading to an escalation of privilege that can compromise data integrity, confidentiality, and availability of any resource in the same AWS account.

The affected product is AWS’s CICD‑toolchain‑for‑serverless‑applications. All instances of versions 1.0.7 to 1.0.10 are impacted. Subsequent releases, version 1.0.11 and later, contain the fix, removing the privilege mis‑assignment.

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, so there is no published exploitation data. However, the likely attack vector is a legitimate authenticated user who has push rights to the repository. If such a user exists, they can initiate a pipeline run that deploys templates affecting resources beyond the application. Provided the user can push or is granted that permission, the risk of exploitation is moderate to high in environments where repository access is not tightly controlled.