~ / search / GHSA-2wm9-hf6c-p5cr

GHSA-2wm9-hf6c-p5cr

ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

Source: GitHub Advisory Database (reviewed) High CVE-2026-45830

Packages

EcosystemPackageAffectedFixed in
PyPI chromadb >= 0.4.17, <= 1.5.9 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

References

External links from the advisory. They lead to third-party sites.