Auth bypass in Chroma Chromadb

CVE-2026-45830

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

Vulnerability class: IDOR (Insecure Direct Object Reference)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS 0.003, 28.3th percentile (scored ); unchanged over 30 days. About EPSS.

Affected products

Weakness classification (CWE)

References