🎯 New Report #3780277: Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
🔺Severity: Medium
👽 Reporter: nick frichette dd
⭐️ Reputation: 331
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-06-03
⏰ Disclosed: 2026-07-02 17:51:21
📝 Summary: A vulnerability was discovered in the Amazon S3 Tables service where certain non-production API endpoints failed to log calls to CloudTrail. This allowed permission enumeration to be performed without leaving any trace in CloudTrail. Twenty-three endpoints were identified that exhibited this behavior, allowing privileged and non-privileged principals to determine the permissions of the accessed identity without generating any CloudTrail events.
📂 Report JSON File: 3780277
@hackeronereports