CVE-2026-107728

Received Received - Intake

Permission Extension Bypass in Strawberry GraphQL

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declares has_permission() as a normal function but returns an awaitable, supports_sync does not classify it as asynchronous, the awaitable is not awaited, and its inherently truthy object value permits the protected resolver to run even when the result would resolve to false. This affects synchronous field resolvers under both execute_sync() and execute(); permissions declared with async def has_permission() and synchronous permissions returning a boolean are not affected. This issue is fixed in version 0.326.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-107728

Affected Vendors & Products

Vendor	Product	Version / Range
strawberry-graphql	strawberry	>= 0.217.0, < 0.326.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects Strawberry GraphQL versions 0.217.0 to 0.326.1. It involves PermissionExtension.resolve() incorrectly evaluating permission checks for synchronous field resolvers. When a custom permission uses a normal function returning an awaitable, the system fails to recognize it as asynchronous, does not await the result, and treats the truthy object value as permission granted. This allows protected resolvers to execute even when permissions should deny access.

Detection Guidance

To detect this vulnerability, check if your Strawberry GraphQL version is between 0.217.0 and 0.326.1. Run: pip show strawberry-graphql. If the version falls in this range, the system is vulnerable.

Impact Analysis

This vulnerability could allow unauthorized access to protected GraphQL resolvers. Attackers might bypass permission checks and execute sensitive operations or retrieve data they should not have access to. The impact includes potential data breaches, unauthorized modifications, or exposure of sensitive information depending on the GraphQL API's functionality.

Compliance Impact

This vulnerability could lead to violations of data protection regulations like GDPR or HIPAA by enabling unauthorized access to personal or health data. Non-compliance may result in legal penalties, fines, or reputational damage due to exposed sensitive information.

Mitigation Strategies

Upgrade Strawberry GraphQL to version 0.326.1 or later immediately. Use: pip install --upgrade strawberry-graphql>=0.326.1. Review custom permission functions to ensure they return boolean values synchronously.

Hi! I’m here to help you understand CVE-2026-107728. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70