Miembros de
Boletines de Vulnerabilidades |
CVE-2026-6912 |
|
| Software afectado | AWS |
|
Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to deployment admin privileges and manage Cognito user accounts via a crafted UpdateUserAttributes API call that sets the custom:deployment_admin attribute. To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes. |
|
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-6912 | |
