CVE-2026-107728
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Strawberry GraphQL from 0.217.0 until 0.326.1 has a vulnerability where PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declares has_permission() as a normal function but returns an awaitable, supports_sync does not classify it as asynchronous, the awaitable is not awaited, and its inherently truthy object value permits the protected resolver to run even when the result would resolve to false.
Risk Assessment
Protected fields may execute despite unmet permission conditions, leading to access control bypass. This affects synchronous field resolvers under both execute_sync() and execute().
Recommendation
Update Strawberry GraphQL to version 0.326.1 or later. Check that custom permissions do not return awaitables from synchronous functions.
Other vulnerabilities in Strawberry GraphQL
See all- CVE-2026-107727Low
Strawberry GraphQL versions 0.312.3 through 0.327.2 do not remove completed operations from task and subscription lists in the legacy graphql-ws handler. With a configured per-connection subscription limit, a client can exhaust the limit, blocking later legitimate operations. Fixed in version 0.327.2.
- CVE-2026-47707Medium
Strawberry GraphQL versions 0.172.0 through 0.315.6 incorrectly count aliases when expanding FragmentSpreadNode. An attacker can bypass alias limits and force the server to resolve a significantly higher number of aliases than allowed, leading to resource exhaustion and denial of service (DoS).
- CVE-2026-47706Medium
Strawberry GraphQL versions 0.71.0 through 0.315.6 are vulnerable to a DoS attack in the QueryDepthLimiter extension. Lack of cycle detection in fragment spreads causes infinite recursion and a RecursionError. Fixed in version 0.315.7.
- CVE-2026-45739Low
In Strawberry GraphQL versions 0.288.4 through 0.315.3, the bundled GraphiQL template wrote header editor values into the browser URL query string. This could expose sensitive headers like authorization tokens.
Original NVD description (English source)
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declares has_permission() as a normal function but returns an awaitable, supports_sync does not classify it as asynchronous, the awaitable is not awaited, and its inherently truthy object value permits the protected resolver to run even when the result would resolve to false. This affects synchronous field resolvers under both execute_sync() and execute(); permissions declared with async def has_permission() and synchronous permissions returning a boolean are not affected. This issue is fixed in version 0.326.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS