All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing…

Description

All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

Scores

EPSS (exploitation in 30 days)

0.28% · top 79% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

• CWE-639 Authorization bypass through User-Controlled key (opens in a new tab)All about CWE-639 and its CVEs
• CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization (opens in a new tab)All about CWE-551 and its CVEs

Affected products

• Chroma · ChromaDB

  • affected 0.5.0 – ≤ *

References (4)

• https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-4 (opens in a new tab)
• https://access.redhat.com/security/cve/CVE-2026-45832 (opens in a new tab)vdb-entryx_refsource_REDHAT
• RHBZ#2488411 (opens in a new tab)issue-trackingx_refsource_REDHAT
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45832.json (opens in a new tab)x_sadp-csaf-vex

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-45832](https://trackcve.app/badge/CVE-2026-45832.svg)](https://trackcve.app/cve/CVE-2026-45832)

Record last updated 31 Jul 2026, 12:04 UTC.