CVE-2026-45830
EUVD-2026-3646112.06.2026, 16:16
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| trychroma | chromadb | 0.4.17 ≤ 𝑥 ≤ 1.5.9 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-639 - Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- CWE-266 - Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.