CVE-2026-107728

Summary

A permission bypass flaw in Strawberry GraphQL allows attackers to execute protected resolvers by incorrectly handling async permission checks. When custom permissions return awaitables without proper async classification, the system treats them as synchronous and permits access even when permissions should be denied.

Exploitability

Exploitation is moderately difficult as it requires crafting a custom permission class that returns an awaitable from has_permission() while being defined as a synchronous function, but once created, the flaw can be leveraged to bypass access controls on GraphQL endpoints.

Blast radius

The impact could be significant across all GraphQL APIs using Strawberry GraphQL versions 0.217.0 through 0.326.0, potentially allowing unauthorized data access or manipulation through bypassed field resolvers.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.326.1 or later to fix the permission evaluation logic for synchronous field resolvers.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.