Home

Description

A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

PUBLISHED Reserved 2026-05-18 | Published 2026-06-12 | Updated 2026-06-12 | Assigner HiddenLayer




HIGH: 8.8CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Problem types

CWE-639 Authorization bypass through User-Controlled key

Product status

Default status
unaffected

1.0.0 (custom)
affected

References

www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-2

cve.org (CVE-2026-8828)

nvd.nist.gov (CVE-2026-8828)

Download JSON