CVE-2026-107728
2 advisories.
PyPI/strawberry-graphql CVE-2026-107728: high 7.5, EPSS 0.35%
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
Action: Upgrade strawberry-graphql to 0.326.1 or later.
pip install strawberry-graphql==0.326.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.217.0 | 0.326.1 | - |
Fixed versions
| 0.326.1 |
Sources
- osv: GHSA-pfvf-fwfp-25mp
- https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-pfvf-fwfp-25mp
- https://nvd.nist.gov/vuln/detail/CVE-2026-107728
- https://github.com/strawberry-graphql/strawberry/pull/4605
- https://github.com/strawberry-graphql/strawberry/commit/2ebb79796c0e5ebb43cae1abd2b5a21363b1c00e
- https://github.com/strawberry-graphql/strawberry
- https://github.com/strawberry-graphql/strawberry/releases/tag/0.326.1
CVE-2026-107728 · published · modified · JSON
PyPI/strawberry-graphql CVE-2026-107728: high 7.5, EPSS 0.35%
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
Action: Upgrade strawberry-graphql to 0.326.1 or later.
pip install strawberry-graphql==0.326.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.217.0 | 0.326.1 | - |
Fixed versions
| 0.326.1 |
Sources
- osv: PYSEC-2026-4303
- https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-pfvf-fwfp-25mp
- https://nvd.nist.gov/vuln/detail/CVE-2026-107728
- https://github.com/strawberry-graphql/strawberry/pull/4605
- https://github.com/strawberry-graphql/strawberry/commit/2ebb79796c0e5ebb43cae1abd2b5a21363b1c00e
- https://github.com/strawberry-graphql/strawberry
- https://github.com/strawberry-graphql/strawberry/releases/tag/0.326.1
- https://pypi.org/project/strawberry-graphql
- https://github.com/advisories/GHSA-pfvf-fwfp-25mp
CVE-2026-107728 · published · modified · JSON