CVE-2026-107728 · GHSA-pfvf-fwfp-25mp

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Risk score: 61/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.4%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declares has_permission() as a normal function but returns an awaitable, supports_sync d…
Affected: strawberry-graphql (pip) >= 0.217.0, <= 0.326.0
Fix: Upgrade strawberry-graphql to 0.326.1 or later.
Exploitation: No known exploitation

Why it is Amber

CVSS 7.5 high
Remotely exploitable without logging in
On your watchlist: PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
strawberry-graphql	pip	>= 0.217.0, <= 0.326.0	0.326.1

References

Original description

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declares has_permission() as a normal function but returns an awaitable, supports_sync does not classify it as asynchronous, the awaitable is not awaited, and its inherently truthy object value permits the protected resolver to run even when the result would resolve to false. This affects synchronous field resolvers under both execute_sync() and execute(); permissions declared with async def has_permission() and synchronous permissions returning a boolean are not affected. This issue is fixed in version 0.326.1.

Last activity 8 Oct 2026. Patch Forecast updates every hour.