{"data":{"id":"ddb4679b-e903-4693-9ef6-542e94971b61","title":"CVE-2026-45830: A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated…","summary":"CVE-2026-45830 is an authorization validation flaw in version 0.4.17 or later of the ChromaDB Python project. Any authenticated user can read, write, update, or delete data in any tenant's collection, regardless of which tenant they belong to. HiddenLayer assigned a CVSS 4.0 score of 8.8 (HIGH), and NIST has not yet provided an assessment.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45830","publishedAt":"2026-06-12T16:16:28.660Z","cveId":"CVE-2026-45830","cweIds":["CWE-639"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["chromadb@>= 0.4.17, <= 1.5.9"],"affectedPackageNames":["chromadb"],"affectedPackageRefs":["pypi:chromadb"],"affectedVendors":[],"affectedVendorsRaw":["ChromaDB"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ChromaDB Python authorization flaw allows cross-tenant data access","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00345,"epssCheckedAt":"2026-11-04T18:09:14.050Z","kevDateAdded":null,"advisoryAliases":["GHSA-2wm9-hf6c-p5cr"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:47:40.613Z","patchAvailable":null,"disclosureDate":"2026-06-12T16:16:28.660Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}