CVE-2026-45832
EUVD-2026-3648312.06.2026, 16:16
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| trychroma | chromadb | 0.5.0 ≤ 𝑥 ≤ 1.5.9 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-639 - Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and CanonicalizationIf a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.