CVE-2026-45831: ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

June 12, 2026 (updated August 24, 2026)

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.

References

github.com/advisories/GHSA-xph7-9rjv-w5fr
github.com/chroma-core/chroma/issues/7588
github.com/chroma-core/chroma/pull/7602
nvd.nist.gov/vuln/detail/CVE-2026-45831
www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-3

Code Behaviors & Features

Detect and mitigate CVE-2026-45831 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →