Description (CNA)
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Chroma / ChromaDB | affected 0.5.0 through * |
CWE
CWE-639
References
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in ChromaDB. All V1 collection-level endpoints in the Python project pass null values for tenant and database to the authorization layer. This allows a remote attacker to bypass authorization controls by utilizing these V1 endpoints. The primary consequence is unauthorized access, potentially leading to high impact on confidentiality and integrity of data.