CVE-2026-107728: CWE-863: Incorrect Authorization in strawberry-graphql strawberry

Strawberry GraphQL versions >=0.217.0 and <0.326.1 contain an authorization bypass due to improper handling of asynchronous permission checks in synchronous field resolvers. Specifically, PermissionExtension.resolve() evaluates the result of has_permission() for truthiness without awaiting it if has_permission() returns an awaitable but is declared as a normal function. This causes inherently truthy awaitable objects to permit access erroneously. Permissions implemented as async functions or synchronous boolean-returning functions are not affected. The issue is resolved in version 0.326.1.

An attacker could gain unauthorized access to GraphQL resolvers protected by custom permissions that return awaitables from has_permission() but are declared synchronously. This leads to a bypass of intended authorization controls, potentially exposing sensitive data or functionality. The CVSS 3.1 score is 7.5 (high), reflecting network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

Upgrade strawberry-graphql to version 0.326.1 or later, where this authorization bypass is fixed. No other mitigations are indicated or required as the fix addresses the root cause. Users should verify that custom permission implementations conform to expected async or sync patterns to avoid similar issues.