CVE-2026-45830

Modified Modified - Updated After Analysis

Authorization Bypass in ChromaDB Python Project

Publication date: 2026-06-12

Last updated on: 2026-06-30

Assigner: HiddenLayer

Description

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-30

Generated

2026-07-02

AI Q&A

2026-06-12

EPSS Evaluated

2026-07-01

NVD

CVE-2026-45830

EUVD

EUVD-2026-36461

Affected Vendors & Products

Vendor	Product	Version / Range
trychroma	chromadb	From 0.4.17 (inc) to 1.5.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in version 0.4.17 or later of the ChromaDB Python project. It is caused by a lack of authorization validation, which means that any authenticated user can access data across different tenants without proper permission checks.

Specifically, an authenticated user can arbitrarily read, write, update, or delete data in any tenant's collection, regardless of which tenant they belong to.

Impact Analysis

This vulnerability can have serious impacts because it allows unauthorized access and modification of data across tenants.

Confidential data from other tenants can be read without permission.
Data can be altered or deleted by unauthorized users, leading to data integrity issues.
It can result in data breaches, loss of trust, and potential operational disruptions.

Compliance Impact

The vulnerability allows any authenticated user to access and modify data across tenants without proper authorization validation. This unauthorized access to data can lead to violations of data protection principles required by standards such as GDPR and HIPAA, which mandate strict controls on data access and tenant isolation to protect personal and sensitive information.

Specifically, the arbitrary read, write, update, or deletion of data in any tenant's collection regardless of tenant boundaries can result in breaches of confidentiality, integrity, and availability of data, which are core requirements in these regulations.

Hi! I’m here to help you understand CVE-2026-45830. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70