CVE-2026-45831: ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

June 12, 2026 (updated August 24, 2026)

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.

References

github.com/advisories/GHSA-xph7-9rjv-w5fr
github.com/chroma-core/chroma/issues/7588
github.com/chroma-core/chroma/pull/7602
nvd.nist.gov/vuln/detail/CVE-2026-45831
www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-3

Code Behaviors & Features

Detect and mitigate CVE-2026-45831 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →