CVE-2026-107728

An IMPORTANT severity (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) flaw was found in the strawberry-GraphQL Python library, which is bundled in the Red Hat Exploit Intelligence vulnerability-analysis container image. When evaluating permissions on synchronous field resolvers, PermissionExtension.resolve() checks the return value of has_permission() for truthiness without awaiting it. When a custom permission class declares has_permission() as a normal function that returns an awaitable, the library does not treat the check as asynchronous, the awaitable is never awaited, and its inherently truthy value allows the protected resolver to run even when the permission result would resolve to false. A remote attacker who can send queries to an application using this specific permission pattern can therefore bypass authorization checks on protected GraphQL fields and access data they are not authorized to see, resulting in information disclosure. Permission classes that declare has_permission() with async def, or that return a plain boolean, are evaluated correctly and are not affected. The Red Hat severity rating matches the upstream assessment. The affected Red Hat Exploit Intelligence component is tracked with a delegated resolution, and a fix is being pursued for the affected offering.