VYPR
← All advisories
High severity8.8NVD Advisory· Published Apr 24, 2026· Updated Apr 24, 2026

CVE-2026-6912

CVE-2026-6912

Description

Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to deployment admin privileges and manage Cognito user accounts via a crafted UpdateUserAttributes API call that sets the custom:deployment_admin attribute.

To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • AWS/AWS Ops Wheelreferences2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: < #165

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.