FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

py-strawberry-graphql -- Incorrect authorization

Affected packages
py310-strawberry-graphql < 0.326.1
py311-strawberry-graphql < 0.326.1
py312-strawberry-graphql < 0.326.1
py313-strawberry-graphql < 0.326.1
py313t-strawberry-graphql < 0.326.1
py314-strawberry-graphql < 0.326.1
py314t-strawberry-graphql < 0.326.1
py315-strawberry-graphql < 0.326.1
py312-dj60-strawberry-graphql < 0.326.1
py313-dj60-strawberry-graphql < 0.326.1
py313t-dj60-strawberry-graphql < 0.326.1
py314-dj60-strawberry-graphql < 0.326.1
py314t-dj60-strawberry-graphql < 0.326.1
py315-dj60-strawberry-graphql < 0.326.1

Details

VuXML ID 1ee62c05-a646-11f1-b187-901b0edee044
Discovery 2026-09-01
Entry 2026-09-02

Patrick Arminio reports:

"PermissionExtension.resolve()" evaluates the return value of "has_permission()" for truthiness on the synchronous path. "supports_sync" only classifies a permission as asynchronous when "has_permission" is declared with "async def" (via "inspect.iscoroutinefunction"), so a plain "def" that returns an awaitable is treated as synchronous. An awaitable is always truthy, so the check passes even when it resolves to "False" and the protected resolver runs. The resolve path is chosen by the field resolver, not by the execution method, so any field with a synchronous resolver is affected under both "execute_sync()" and "execute()". Permissions declared with "async def has_permission()", or a plain "def" returning a boolean, are not affected.

References

URL https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-pfvf-fwfp-25mp