GHSA-2wm9-hf6c-p5cr

Source

https://github.com/advisories/GHSA-2wm9-hf6c-p5cr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2wm9-hf6c-p5cr/GHSA-2wm9-hf6c-p5cr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2wm9-hf6c-p5cr

Aliases

Downstream

CGA (2)

Published

2026-06-12T18:31:56Z

Modified

2026-09-10T12:25:31Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

Details

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

Database specific

{
    "cwe_ids":  [
        "CWE-266",
        "CWE-639"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-24T19:57:41Z",
    "nvd_published_at":  "2026-06-12T16:16:28Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / chromadb

Package

Name: chromadb; View open source insights on deps.dev
Purl: pkg:pypi/chromadb

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.4.17

Last Affected

1.5.9

Affected versions

0.*

0.4.17

0.4.18

0.4.19

0.4.20

0.4.21

0.4.22

0.4.23

0.4.24

0.5.0

0.5.1

0.5.2

0.5.3

0.5.4

0.5.5

0.5.7

0.5.9

0.5.10

0.5.11

0.5.12

0.5.13

0.5.15

0.5.16

0.5.17

0.5.18

0.5.20

0.5.21

0.5.23

0.6.0

0.6.1

0.6.2

0.6.3

1.*

1.0.0b0

1.0.0

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.0.12

1.0.13

1.0.15

1.0.16

1.0.17

1.0.18

1.0.19

1.0.20

1.0.21

1.1.0

1.1.1

1.2.0

1.2.1

1.2.2

1.3.0

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.4.0

1.4.1

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2wm9-hf6c-p5cr/GHSA-2wm9-hf6c-p5cr.json"