Description (CNA)
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Chroma / ChromaDB | affected 0.4.17 through * |
CWE
CWE-639
References
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in ChromaDB. A lack of authorization validation in the ChromaDB Python project allows any authenticated user to read, write, update, or delete data in any tenant's collection. This means an attacker can bypass intended access controls and manipulate data across different tenants, leading to unauthorized data access and modification.