PYSEC-2026-3815
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/chromadb/PYSEC-2026-3815.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-3815
- Aliases
- Published
- 2026-09-10T09:44:49Z
- Modified
- 2026-09-10T12:15:06Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator
- Summary
- ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to
- Details
-
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2026-45831
- https://github.com/chroma-core/chroma/issues/7588
- https://github.com/chroma-core/chroma/pull/7602
- https://github.com/chroma-core/chroma
- https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-3
- https://pypi.org/project/chromadb
- https://github.com/advisories/GHSA-xph7-9rjv-w5fr
Affected packages
PyPI / chromadb
Package
- Name
- chromadb
- View open source insights on deps.dev
- Purl
- pkg:pypi/chromadb
Affected versions
0.*
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.7
0.5.9
0.5.10
0.5.11
0.5.12
0.5.13
0.5.15
0.5.16
0.5.17
0.5.18
0.5.20
0.5.21
0.5.23
0.6.0
0.6.1
0.6.2
0.6.3
1.*
1.0.0b0
1.0.0
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.0.11
1.0.12
1.0.13
1.0.15
1.0.16
1.0.17
1.0.18
1.0.19
1.0.20
1.0.21
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
1.3.0
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.5.9