CVE-2026-45832 HIGH

CVE-2026-45832

Vendor Chroma
Product ChromaDB
Weakness CWE-639 · IDOR
Published June 12, 2026
Last update June 30, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

What the vulnerability does

01Description

All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

Key dates

02Disclosure timeline

June 12, 2026 CVE published
June 30, 2026 Record updated