{"items":[{"id":"NVI-00011752","kind":"vulnerability","title":"Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pfvf-fwfp-25mp","CVE-2026-107728"],"plain_summary":"GitHub lists this reviewed advisory for strawberry-graphql. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0d6befd467a7e8a50d28aeabbe29441e"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-09T14:07:19.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-19417aceecb1e929fe53842c0819ebd4"},{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"0.449%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.39067. Missing scores are unknown.","source_id":"sr-0d6befd467a7e8a50d28aeabbe29441e"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-19417aceecb1e929fe53842c0819ebd4","url":"https://github.com/advisories/GHSA-pfvf-fwfp-25mp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pfvf-fwfp-25mp","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:23.763Z"},{"id":"sr-0d6befd467a7e8a50d28aeabbe29441e","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-107728","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:44:07.774Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-19417aceecb1e929fe53842c0819ebd4"],"technology":"strawberry-graphql","known_exclusions":[],"conditions_summary":"### Summary\n\n`PermissionExtension.resolve()` evaluates the return value of `has_permission()` for truthiness on the synchronous path. `supports_sync` only classifies a permission as asynchronous when `has_permission` is declared with `async def` (via `inspect.iscoroutinefunction`), so a plain `def` that returns an awaitable is treated as synchronous. An awaitable is always truthy, so the check passes even when it resolves to `False` and the protected resolver runs.\n\nThe resolve path is chosen by the field resolver, not by the execution method, so any field with a synchronous resolver is affected under both `execute_sync()` and `execute()`. Permissions declared with `async def has_permission()`, or a plain `def` returning a boolean, are not affected.\n\n### Details\n\nThe affected code is `PermissionExtension.resolve()` in `strawberry/permission.py`. A permission attached to a field whose `has_permission` is a normal `def` returning an awaitable reaches this path; the awaitable is never awaited and its truthiness grants access. `resolve_async()` is not affected because it uses `await_maybe()`.\n\n### PoC\n\n```python\nimport strawberry\nfrom strawberry.permission import BasePermission\n\n\nclass","public_affected_ranges":[">= 0.217.0, <= 0.326.0"]}],"null_published_at":"2026-11-06T00:29:57.250Z","source_updated_at":"2026-10-09T14:07:19.000Z","source_disclosed_at":"2026-10-09T14:07:16.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T00:58:23.763Z"},{"id":"NVI-00011752","kind":"vulnerability","title":"Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pfvf-fwfp-25mp","CVE-2026-107728"],"plain_summary":"GitHub lists this reviewed advisory for strawberry-graphql. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-19417aceecb1e929fe53842c0819ebd4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-09T14:07:19.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-19417aceecb1e929fe53842c0819ebd4"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-19417aceecb1e929fe53842c0819ebd4","url":"https://github.com/advisories/GHSA-pfvf-fwfp-25mp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pfvf-fwfp-25mp","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:23.763Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-19417aceecb1e929fe53842c0819ebd4"],"technology":"strawberry-graphql","known_exclusions":[],"conditions_summary":"### Summary\n\n`PermissionExtension.resolve()` evaluates the return value of `has_permission()` for truthiness on the synchronous path. `supports_sync` only classifies a permission as asynchronous when `has_permission` is declared with `async def` (via `inspect.iscoroutinefunction`), so a plain `def` that returns an awaitable is treated as synchronous. An awaitable is always truthy, so the check passes even when it resolves to `False` and the protected resolver runs.\n\nThe resolve path is chosen by the field resolver, not by the execution method, so any field with a synchronous resolver is affected under both `execute_sync()` and `execute()`. Permissions declared with `async def has_permission()`, or a plain `def` returning a boolean, are not affected.\n\n### Details\n\nThe affected code is `PermissionExtension.resolve()` in `strawberry/permission.py`. A permission attached to a field whose `has_permission` is a normal `def` returning an awaitable reaches this path; the awaitable is never awaited and its truthiness grants access. `resolve_async()` is not affected because it uses `await_maybe()`.\n\n### PoC\n\n```python\nimport strawberry\nfrom strawberry.permission import BasePermission\n\n\nclass","public_affected_ranges":[">= 0.217.0, <= 0.326.0"]}],"null_published_at":"2026-11-01T01:03:56.600Z","source_updated_at":"2026-10-09T14:07:19.000Z","source_disclosed_at":"2026-10-09T14:07:16.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:58:23.763Z"}],"next_cursor":null,"snapshot_revision":"42594"}