{"uuid": "69a1bbb0-ac13-434a-ae39-c60aeca4daab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107728", "type": "seen", "source": "https://gist.github.com/alon710/3f4a231234c89945ddbbd06ebc24e753", "content": "# CVE-2026-107728: CVE-2026-107728: Authorization Bypass in Strawberry GraphQL Permission Validation\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107728\n\n## Summary\nAn authorization bypass vulnerability in Strawberry GraphQL between versions 0.217.0 and 0.326.1 occurs when a synchronous permission handler returns an awaitable object (such as an unawaited coroutine). Due to Python's truthiness rules, the unawaited coroutine is evaluated as True, leading to an immediate bypass of security policies.\n\n## TL;DR\nStrawberry GraphQL fails to validate the return types of synchronous permission functions, allowing unawaited coroutines to evaluate as True and bypass access control.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5\n- **EPSS Score**: 0.00353\n- **EPSS Percentile**: 26.95%\n- **Impact**: High (Confidentiality)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- strawberry-graphql\n- **strawberry-graphql**: >= 0.217.0, < 0.326.1 (Fixed in: `0.326.1`)\n\n## Mitigation\n\n- Upgrade strawberry-graphql to version 0.326.1 or higher.\n- Audit custom permissions to ensure synchronous has_permission functions return boolean values.\n- Use async def has_permission if invoking asynchronous operations.\n\n**Remediation Steps:**\n1. Verify the installed strawberry-graphql version using pip show strawberry-graphql.\n2. Update the package using pip install --upgrade strawberry-graphql>=0.326.1.\n3. Scan codebase for BasePermission subclasses and check their return types.\n\n## References\n\n- [GitHub Security Advisory GHSA-pfvf-fwfp-25mp](https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-pfvf-fwfp-25mp)\n- [Fix PR #4605](https://github.com/strawberry-graphql/strawberry/pull/4605)\n- [Fixing Commit](https://github.com/strawberry-graphql/strawberry/commit/2ebb79796c0e5ebb43cae1abd2b5a21363b1c00e)\n- [Release 0.326.1](https://github.com/strawberry-graphql/strawberry/releases/tag/0.326.1)\n- [NVD - CVE-2026-107728](https://nvd.nist.gov/vuln/detail/CVE-2026-107728)\n- [CVE-2026-107728](https://www.cve.org/CVERecord?id=CVE-2026-107728)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107728) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T16:30:32.000000Z"}