Chroma: ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a…
Chroma
More for Chroma RSS feed for Chroma
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-45831
- Affects
- Chroma
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 12, 2026
- Source last modified
- October 26, 2026
Description
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.
Description quoted from the NVD record.
Who is affected
Chroma (also called ChromaDB) is a database that stores information for AI applications so it can be searched by meaning. This flaw affects versions 0.5.0 or later when the product uses its simple built-in feature for controlling what each user is allowed to do based on their role. That feature checks whether a user holds a permission but never checks which tenant (a separate customer or group space), database, or collection of data the permission applies to. As a result, a user with an account could perform actions in other tenants' areas. This flaw is rated High.
What to do
- If you or someone on your staff installed and runs Chroma, have that person check whether it is version 0.5.0 or later and whether it uses the built-in role-based permission feature.
- No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and install it as soon as it is available.
- If an IT provider or vendor runs Chroma for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.