CVE-2024-10953: Amazon Data.all

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member of.

Affected products

• Amazon Data.all: from 1.0.0, before 2.6.1 (fixed in 2.6.1)

Published 2024-11-09. Last modified 2026-06-17.