8.8
High
CVE-2026-45831 The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project…
Description
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ChromaDB 0.5 | 0.5.0 → latest | No fix stated |
References
- www.hiddenlayer.com www.hiddenlayer.com
Timeline
- Published
- Last modified
Other CVEs of ChromaDB
The 6 CVEs of ChromaDB →
CVE-2026-45833
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated…
9.4
Critical
CVE-2026-45832
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the…
8.8
High
CVE-2026-8828
A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users…
8.8
High
CVE-2026-45830
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated…
8.8
High