A missing authorization check in Amazon Connect Salesforce Lambda allows any IAM principal that can invoke the function to call privileged AWS service APIs with parameters supplied by the caller. This enables an attacker to perform AWS API operations that their own IAM identity is explicitly denied, effectively bypassing IAM permissions and elevating privileges. The weakness is a lack of proper authorization validation before forwarding requests to AWS services.

The vulnerability affects Amazon Connect Salesforce Lambda prior to version 5.26, specifically the sfExecuteAWSService Lambda dispatcher. Systems using earlier releases of this function in any environment are susceptible unless the function is disabled or removed.

The CVSS score of 6.4 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is an internal AWS IAM user or service with lambda:InvokeFunction permission, who can invoke the function and trigger unauthorized service calls without further validation. Because the attacker only needs invoke permissions, any entity granted that permission can exploit the flaw, making the risk significant for organizations that do not enforce strict least privilege on Lambda invocation.