GitHub Advisoryadvisory · PyPI

GHSA-2wm9-hf6c-p5cr ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

HIGH Published 2026-06-12 Modified 2026-08-24 Official page ↗
Aliases
CVE-2026-45830
Ecosystem
PyPI
Packages
chromadb
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-266, CWE-639
Reviewed
2026-08-24

Affected packages

• PyPI chromadb: >= 0.4.17, <= 1.5.9 (no fix yet)

Description

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

Related

Alias · CVE (1)

  • CVE-2026-45830 A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily… vulnerability

Weakness · CWE (2)

  • CWE-266 Incorrect Privilege Assignment weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References