Strawberry GraphQL
CVE-2026-107728
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable and unauthenticated bypass (AV:N/PR:N), but AC:H because exploitation depends on a specific non-default permission coding pattern outside attacker control; impact is primarily unauthorized data disclosure (C:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declares has_permission() as a normal function but returns an awaitable, supports_sync does not classify it as asynchronous, the awaitable is not awaited, and its inherently truthy object value permits the protected resolver to run even when the result would resolve to false. This affects synchronous field resolvers under both execute_sync() and execute(); permissions declared with async def has_permission() and synchronous permissions returning a boolean are not affected. This issue is fixed in version 0.326.1.
AnalysisAI
Strawberry GraphQL versions 0.217.0 through 0.326.0 contain an authorization bypass in which a custom permission class whose has_permission() is declared as a synchronous def but returns an awaitable (for example a coroutine) can grant access to fields that should be denied. Because only async def methods are detected as asynchronous, the returned awaitable is evaluated for truthiness on the synchronous resolve path and is always truthy, so the protected resolver runs even when the awaitable would resolve to False. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target application to define a custom permission (BasePermission) whose has_permission() is declared as a synchronous `def` yet returns an awaitable/coroutine, and the protected field must use a synchronous resolver (triggerable under both execute_sync() and execute()). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, unauthenticated authorization bypass (CWE-863) with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to strawberry-graphql 0.326.1, which makes the synchronous permission path fail closed by raising PermissionReturnedAwaitableInSyncContextError instead of trusting an awaitable, as implemented in PR #4605 (commit 2ebb79796c0e5ebb43cae1abd2b5a21363b1c00e) and published in the release at https://github.com/strawberry-graphql/strawberry/releases/tag/0.326.1 with advisory guidance at https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-pfvf-fwfp-25mp. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every service, container image, and dependency lockfile for Strawberry GraphQL versions 0.217.0 through 0.326.0 (including transitive installs) and identify any permission class whose has_permission() is declared with synchronous def but can return an awaitable or coroutine, since under execute_sync() and execute() those results are evaluated for truthiness on the synchronous resolve path and are always truthy; where found, immediately convert those methods to async def or force them to return a strict plain boolean (for example, by awaiting the coroutine before returning), and treat any field guarded solely by such a permission as temporarily unprotected. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Strawberry
View allDenial-of-service via alias amplification in Strawberry GraphQL (versions 0.172.0 through 0.315.6) allows unauthenticate
Infinite recursion in Strawberry GraphQL's QueryDepthLimiter extension allows unauthenticated remote attackers to crash
Strawberry GraphQL is a library for creating GraphQL APIs. Rated high severity (CVSS 8.0), this vulnerability is remotel
Uncontrolled resource consumption in the Strawberry GraphQL library's legacy graphql-ws subscription handler (versions 0
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today