Catalogue CVE

CVE-2026-45830

A lack of authorization validation in version 0.4.17…

[Catalogue CVE]

A flaw was found in ChromaDB. A lack of authorization validation in the ChromaDB Python project allows any authenticated user to read, write, update, or delete data in any tenant's collection. This means an attacker can bypass intended access controls and manipulate data across different tenants, leading to unauthorized data access and modification. chromadb: ChromaDB: Unauthorized data manipulation due to improper authorization validation This flaw is Post-authentication IDOR: ChromaDB resolves collections by UUID without tenant/database filtering, allowing any authenticated user who knows a collection UUID to access any tenant’s data. High severity for confidentiality and integrity; not Critical because authentication is required and there is no code execution or availability impact. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Gravité
High · CVSS 8.8CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedchromadbNot reportedUnknownSource applicability is not establishedProvider not reported
PyPIRelease not reportedchromadbNot reportedUnknownSource applicability is not establishedGHSA-2WM9-HF6C-P5CR[PYSEC-2026-3813]
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedchromadbNot reportedUnknownSource applicability is not establishedProvider not reported
PyPIRelease not reportedchromadbNot reportedUnknownSource applicability is not establishedGHSA-2WM9-HF6C-P5CR[PYSEC-2026-3813]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "chromadb",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "chromadb",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0.4.17"
            },
            {
              "last_affected": "1.5.9"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "",
      "provider_record_id": "GHSA-2WM9-HF6C-P5CR",
      "applicability_unknown": true
    },
    {
      "name": "chromadb",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0.4.17"
            },
            {
              "last_affected": "1.5.9"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "provider_url": "https://osv.dev/vulnerability/PYSEC-2026-3813",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "PYSEC-2026-3813",
      "provider_updated_at": "2026-09-10T12:15:06.103369504Z",
      "applicability_unknown": true
    },
    {
      "name": "chromadb",
      "ranges": [
        {
          "fixed": "",
          "introduced": "0.4.17",
          "last_affected": "1.5.9",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45830",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-45830",
      "provider_updated_at": "2026-10-26T11:10:00.157"
    }
  ]
}

OpenFactory catalog packages

L’association des paquets est en cours.

Observé:

Références

[FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]