CVE-2026-6912

The record

Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to deployment admin privileges and manage Cognito user accounts via a crafted UpdateUserAttributes API call that sets the custom:deployment_admin attribute. To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.

Affected packages

Related vulnerabilities

• CVE-2026-96378 Improperly Controlled Modification of Dynamically-Determined Object Attributes… CWE-915
• CVE-2026-84645 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing… CWE-915
• CVE-2026-84430 A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. CWE-915
• CVE-2026-83557 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically… CWE-915
• CVE-2026-78038 Improperly Controlled Modification of Dynamically-Determined Object Attributes… CWE-915
• CVE-2026-59284 There is no allow list for property keys when Spring Cloud Commons writable /actuator/env… CWE-915
• CVE-2026-47849 Spring Data REST does not guard identifier (@Id) and version (@Version) properties… CWE-915
• CVE-2026-47850 Spring Data REST does not preserve the persisted version (@Version) property of an… CWE-915