The vulnerability in Strawberry GraphQL occurs when a synchronous field resolver is protected by a custom permission that defines has_permission() as a normal function but returns an awaitable. Because the library treats the returned awaitable as a truthy value, the permission check passes even though the awaited result would be false, with insufficient authorization. The flaw is an example of an authorization bypass weakness.

Affected users are anyone who incorporated strawberry-graphql binaries between versions 0.217.0 and 0.326.1, inclusive. These releases are common in Python projects building GraphQL APIs. The issue does not affect permissions defined with async def has_permission() or synchronous permissions returning a literal boolean.

The CVSS score of 7.5 indicates a high severity risk. EPSS is not available but the lack of a KEV listing suggests no widespread exploitation yet. However, the flaw can be exploited by an attacker who can inject or manipulate permission functions, potentially leading to unauthorized data access or privilege escalation, especially in environments that rely heavily on custom synchronous resolvers.