py-strawberry-graphql -- Incorrect authorization

2026-09-02 · VuXML entry

Patrick Arminio reports: "PermissionExtension.resolve()" evaluates the return value of "has_permission()" for truthiness on the synchronous path. "supports_sync" only classifies a permission as asynchronous when "has_permission" is declared with "async def" (via "inspect.iscoroutinefunction"), so a plain "def" that returns an awaitable is treated as synchronous. An awaitable is always truthy, so the check passes …

Affected versions

• py310-strawberry-graphql, py311-strawberry-graphql, py312-strawberry-graphql, py313-strawberry-graphql, py313t-strawberry-graphql, py314-strawberry-graphql, py314t-strawberry-graphql, py315-strawberry-graphql < 0.326.1
• py312-dj60-strawberry-graphql, py313-dj60-strawberry-graphql, py313t-dj60-strawberry-graphql, py314-dj60-strawberry-graphql, py314t-dj60-strawberry-graphql, py315-dj60-strawberry-graphql < 0.326.1

By system

1 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.