CVE-2026-45831 Details
Description
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.
A vulnerability in the SimpleRBACAuthorizationProvider of the ChromaDB Python project, present in versions 0.5.0 and later, allows users to perform actions across different tenants without proper authorization checks. The provider evaluates user permissions but fails to consider the specific tenant, database, or collection to which those permissions apply. As a result, a user with read access to one tenant can access data from any tenant, and a user with write access can modify data across all tenants.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-3 | HiddenLayer | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | HiddenLayer |
Affected Products
| Product | Versions |
|---|---|
| trychroma chromadb | >= 0.5.0, <= 1.5.9 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | HiddenLayer |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| Jun 12, 2026 | New CVE Received | HiddenLayer |