CVE-2026-45831

Chroma / ChromaDB PUBLISHED

Description (CNA)

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.

Affected (CNA)

Vendor / product	Versions
Chroma / ChromaDB	affected 0.5.0 through *

CWE

CWE-863

References

https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-3

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.