AWS Ops Wheel contains a flaw that allows a remote authenticated user to modify Cognito User Pool attributes through a crafted UpdateUserAttributes API call. The application permits the custom:deployment_admin attribute to be set by anyone who already has an authenticated session. When set, this attribute grants deployment‑level administrative privileges and full control over Cognito user accounts. This is a classic example of CWE‑915, where dynamic user data is improperly validated before being applied to system configuration.

The vulnerability affects installations of AWS Ops Wheel that have not yet integrated the security patch introduced in PR #165. Users running earlier versions of the repository, or any forks or derivative deployments that replicate the original code path, remain exposed. All Cognito User Pools managed by such Ops Wheel instances are at risk.

The identified flaw has a CVSS score of 8.7, denoting high severity, while the EPSS score is reported as <1%, indicating a very low current likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session to the Ops Wheel service and the ability to send a custom UpdateUserAttributes call; therefore the attack vector is remote authenticated. While the high severity suggests that an attacker who succeeds would gain significant administrative control, the low EPSS suggests few or no public exploits exist at present.