{"action":"Upgrade strawberry-graphql to 0.326.1 or later.","affected":[{"fixed":"0.326.1","introduced":"0.217.0"}],"component":"strawberry-graphql","cve_ids":["CVE-2026-107728"],"ecosystem":"PyPI","epss":0.00449,"exploited":false,"fixed_versions":["0.326.1"],"ghsa_id":"GHSA-pfvf-fwfp-25mp","id":"tcs_01M5KHB73RWJZYNXGYES0XJ5WP","modified_at":"2026-10-15T14:45:14.136021655Z","published_at":"2026-10-15T10:22:54.407003Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4303","https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-pfvf-fwfp-25mp","https://nvd.nist.gov/vuln/detail/CVE-2026-107728","https://github.com/strawberry-graphql/strawberry/pull/4605","https://github.com/strawberry-graphql/strawberry/commit/2ebb79796c0e5ebb43cae1abd2b5a21363b1c00e","https://github.com/strawberry-graphql/strawberry","https://github.com/strawberry-graphql/strawberry/releases/tag/0.326.1","https://pypi.org/project/strawberry-graphql","https://github.com/advisories/GHSA-pfvf-fwfp-25mp"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-4303","url":"https://osv.dev/vulnerability/PYSEC-2026-4303"}],"summary":"Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy"}