high8.8
CVE-2026-45831
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given per…
Impact
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | chromadb | >= 0.5.0, <= 1.5.9 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Trychroma | Chromadb | from 0.5.0 through 1.5.9 |