CVE-2026-45832

CVE-2026-45832

All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

Vulnerability class: IDOR (Insecure Direct Object Reference)

Weakness classification (CWE)

References