PT-2026-48897 · Chroma · Chromadb

Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-45832

NVD

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-45832

Affected Products

Chromadb

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-45832 · Security Note
• https://hiddenlayer.com/sai-security-advisory/2026-06-chromadb-4 · Note