{"data":{"id":"d61b1747-7db7-4f42-8140-5cb6cb4a3f8b","title":"CVE-2026-45831: The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project…","summary":"CVE-2026-45831 affects the SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project. The provider checks whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to, which allows cross-tenant actions. HiddenLayer rates it CVSS 4.0 8.8 (High), and NIST has not yet provided an assessment.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45831","publishedAt":"2026-06-12T16:16:28.797Z","cveId":"CVE-2026-45831","cweIds":["CWE-863"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["chromadb@>= 0.5.0, <= 1.5.9"],"affectedPackageNames":["chromadb"],"affectedPackageRefs":["pypi:chromadb"],"affectedVendors":[],"affectedVendorsRaw":["ChromaDB"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ChromaDB SimpleRBACAuthorizationProvider skips tenant and collection scope","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00237,"epssCheckedAt":"2026-11-04T18:09:13.655Z","kevDateAdded":null,"advisoryAliases":["GHSA-xph7-9rjv-w5fr"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:47:40.119Z","patchAvailable":null,"disclosureDate":"2026-06-12T16:16:28.797Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}