PT-2026-109287 — Incorrect Authorization em Pypi Strawberry Graphql

PT-2026-109287 · Pypi · Strawberry Graphql

Publicado

2026-10-09

Atualizado

2026-10-09

CVSS v3.1

7.5

Alta

Vetor

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

PermissionExtension.resolve() evaluates the return value of has permission() for truthiness on the synchronous path. supports sync only classifies a permission as asynchronous when has permission is declared with async def (via inspect.iscoroutinefunction), so a plain def that returns an awaitable is treated as synchronous. An awaitable is always truthy, so the check passes even when it resolves to False and the protected resolver runs.

The resolve path is chosen by the field resolver, not by the execution method, so any field with a synchronous resolver is affected under both execute sync() and execute(). Permissions declared with async def has permission(), or a plain def returning a boolean, are not affected.

Details

The affected code is PermissionExtension.resolve() in strawberry/permission.py. A permission attached to a field whose has permission is a normal def returning an awaitable reaches this path; the awaitable is never awaited and its truthiness grants access. resolve async() is not affected because it uses await maybe().

PoC

python

import strawberry
from strawberry.permission import BasePermission


class DenyViaAwaitable(BasePermission):
  message = "denied"

  def has permission(self, source, info, **kwargs):
    async def result():
      return False

    return result()


@strawberry.type
class Query:
  @strawberry.field(permission classes=[DenyViaAwaitable])
  def secret(self) -> str:
    return "secret"


schema = strawberry.Schema(Query)
print(schema.execute sync("{ secret }").data) # {'secret': 'secret'} instead of a permission error

Impact

An application using a custom permission whose has permission is a normal def returning an awaitable can unintentionally grant access to the protected field. Standard permissions (a def returning a boolean, or an async def) are not affected, so exploitability depends on the application using this specific permission shape.

Fix

The synchronous path now fails closed: if has permission() returns an awaitable, an error is raised instead of granting access.

Correção

Incorrect Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

GHSA-PFVF-FWFP-25MP

Produtos afetados

Strawberry Graphql