Auth bypass in Chroma Chromadb

CVE-2026-8828

A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

Vulnerability class: IDOR (Insecure Direct Object Reference)

Published · last modified .

EPSS exploit prediction

EPSS 0.003, 20.5th percentile (scored ); unchanged over 30 days. About EPSS.

Affected products

Weakness classification (CWE)

References