~ / search / GHSA-xph7-9rjv-w5fr

GHSA-xph7-9rjv-w5fr

ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

Source: GitHub Advisory Database (reviewed) High CVE-2026-45831

Packages

EcosystemPackageAffectedFixed in
PyPI chromadb >= 0.5.0, <= 1.5.9 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.

References

External links from the advisory. They lead to third-party sites.