CVE-2026-45830CWE-639

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update…

High · published June 12, 2026

CVSS v4.0
8.8
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00495 · 41.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-06-12T14:46Z
EPSS history
Timeline
  • 12 JUN 14:46Z
    A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update…
    cvelistv5