---
id: CVE-2026-45830
aliases:
  - GHSA-2wm9-hf6c-p5cr
  - PYSEC-2026-3813
title: >-
  ChromaDB allows any authenticated users to arbitrarily read, write, update, or
  delete data in any tenant's collection
summary: >-
  ChromaDB allows any authenticated users to arbitrarily read, write, update, or
  delete data in any tenant's collection
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: chromadb
product: chromadb
ecosystem: pip
affected:
  - 'chromadb >= 0.4.17, <= 1.5.9'
published: '2026-06-12'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T12:25:31.394776670Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2wm9-hf6c-p5cr'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45830'
  - url: 'https://github.com/chroma-core/chroma/issues/7588'
  - url: 'https://github.com/chroma-core/chroma/pull/7602'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-45830'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2488408'
  - url: 'https://github.com/chroma-core/chroma'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45830.json
  - url: 'https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb'
  - url: 'https://pypi.org/project/chromadb'
  - url: 'https://github.com/advisories/GHSA-2wm9-hf6c-p5cr'
tags:
  - osv
  - pip
epss: 0.00345
epssPercentile: 0.28108
ingestedAt: '2026-08-25T19:26:22.466Z'
---

## Overview

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

## Affected packages

- `chromadb >= 0.4.17, <= 1.5.9`

## Remediation

Refer to the advisory for the patched release.