GHSA-xph7-9rjv-w5fr
Suggest an improvement- Source
- https://github.com/advisories/GHSA-xph7-9rjv-w5fr
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xph7-9rjv-w5fr/GHSA-xph7-9rjv-w5fr.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-xph7-9rjv-w5fr
- Aliases
- Downstream
- Published
- 2026-06-12T18:31:56Z
- Modified
- 2026-09-10T12:25:45Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator
- Summary
- ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to
- Details
-
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.
- Database specific
{ "cwe_ids": [ "CWE-863" ], "github_reviewed": true, "github_reviewed_at": "2026-08-24T20:00:42Z", "nvd_published_at": "2026-06-12T16:16:28Z", "severity": "HIGH" }- References
Affected packages
PyPI / chromadb
Package
- Name
- chromadb
- View open source insights on deps.dev
- Purl
- pkg:pypi/chromadb
Affected versions
0.*
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.7
0.5.9
0.5.10
0.5.11
0.5.12
0.5.13
0.5.15
0.5.16
0.5.17
0.5.18
0.5.20
0.5.21
0.5.23
0.6.0
0.6.1
0.6.2
0.6.3
1.*
1.0.0b0
1.0.0
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.0.11
1.0.12
1.0.13
1.0.15
1.0.16
1.0.17
1.0.18
1.0.19
1.0.20
1.0.21
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
1.3.0
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.5.9