CVE-2026-45831
Fixed in a distro release EPSS <1%CVSS 8.8
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.
Products: ChromaDB
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | chromadb | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | open-webui | 0 |
| Wolfi | open-webui | 0 |