🎯 New Report #3577145: QuickSight Authorization Bypass: Chat Agents Accessible Despite Custom Permissions Denial
🔺Severity: None
👽 Reporter: jcow
⭐️ Reputation: 7776
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-03-04
⏰ Disclosed: 2026-05-12 14:54:33
📝 Summary: A vulnerability was discovered in Amazon Quick Suite (formerly QuickSight) that allowed users to access and interact with AI chat agents, despite administrative restrictions being in place to disable this functionality. The vulnerability was caused by the lack of proper server-side authorization checks, which enabled users to bypass the configured custom permissions and access the AI chat agents.
📂 Report JSON File: 3577145
@hackeronereports