CVE-2024-10953: data.all authenticated users can perform mutating update operations on persisted notification records

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-09 · updated 2026-06-17
Weakness: CWE-863

Description

An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member of.

Affected products

amazon data.all: from 1.0.0 before 2.6.1 — fixed in 2.6.1

How to fix

Upgrade to a fixed version: amazon data.all 2.6.1. Check the vendor advisory for mitigations.

References

https://aws.amazon.com/security/security-bulletins/AWS-2024-013
https://github.com/data-dot-all/dataall/releases/tag/v2.6.1
https://github.com/data-dot-all/dataall/security/advisories/GHSA-x4j5-jm65-vp5j

Get alerted when CVE-2024-10953 or the next vulnerability affects your stack