{"data":{"id":"748838e1-1f7b-491c-9f98-f6bd246c813f","title":"CVE-2026-45832: All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the…","summary":"CVE-2026-45832 affects all V1 collection-level endpoints in ChromaDB's Python project. These endpoints pass None for the tenant and database to the authorization layer, which allows attackers to bypass authorization controls by using the V1 endpoints. HiddenLayer assigned a CVSS 4.0 base score of 8.8 (HIGH), and NVD had not yet provided its own assessment at the time of publication.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45832","publishedAt":"2026-06-12T16:16:28.933Z","cveId":"CVE-2026-45832","cweIds":["CWE-639"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["ChromaDB"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ChromaDB authorization bypass through V1 collection-level endpoints","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00284,"epssCheckedAt":"2026-11-04T12:08:33.171Z","kevDateAdded":null,"advisoryAliases":["GHSA-x97m-f58v-9cwg"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T00:09:40.444Z","patchAvailable":null,"disclosureDate":"2026-06-12T16:16:28.933Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}