CVE-2026-6912CWE-915

Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel

High · published April 24, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
61.4
In the wild
Unconfirmed
What it is

Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to deployment admin privileges and manage Cognito user accounts via a crafted UpdateUserAttributes API call that sets the custom:deployment_admin attribute.

To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.00966 · 61.4th percentile
Weakness
CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2026-04-24T16:11Z
EPSS history
Timeline
  • 24 APR 16:11Z
    Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel
    cvelistv5