CVE-2026-45831

EUVD-2026-36482
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 14%
Affected Products (NVD)
VendorProductVersion
trychromachromadb
0.5.0 ≤
𝑥
≤ 1.5.9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-3