Chroma: ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in…
Chroma
More for Chroma RSS feed for Chroma
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-45830
- Affects
- Chroma
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 12, 2026
- Source last modified
- October 26, 2026
Description
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.
Description quoted from the NVD record.
Who is affected
Chroma (also called ChromaDB) is a database that AI applications use to store and search information by meaning. This flaw affects version 0.4.17 and later. The product can keep data for several separate groups, called tenants, apart from each other. Because the product does not properly check what each signed-in user is allowed to do, anyone with a valid login could read, add, change or delete data in any group's collections, not just their own. This flaw is rated High.
What to do
- If someone in your organization installed or runs Chroma, ask them to check whether it is version
0.4.17or later, since those versions have this flaw. - No fixed version is named for this flaw yet, so the person who runs Chroma should check the vendor advisory linked on this page for a fixed release and install it once it is available.
- If an IT provider or vendor runs Chroma for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.