Executive brief
ChromaDB is a popular vector database used to store and retrieve embeddings in AI applications. Due to a missing authorization check, any person with login credentials can access, modify, or delete data belonging to other customers in multi-tenant deployments. This breaks the isolation between different organizations using the same ChromaDB instance, potentially exposing sensitive data and allowing unauthorized tampering with critical information.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) / authorization bypass in ChromaDB's collection lookup mechanism. The root cause lies in chromadb/db/mixins/sysdb.py where the SQL query explicitly skips tenant and database filtering when a collection ID (UUID) is provided, with a code comment stating "Given an id, we can uniquely identify the collection so we don't need to filter databases." The SegmentAPI._get_collection() method in chromadb/api/segment.py calls get_collections(id=collection_id) with no tenant context, and since UUIDs are globally unique, the tenant filter is bypassed. The attack requires network access and valid authentication credentials, but no user interaction or elevated privileges. An attacker who knows a collection UUID from another tenant can perform full CRUD operations on that data. No patch version has been released as of the advisory date.
Affected products
- ChromaDB chromadb 0.4.17 through 1.5.9
Timeline
- 2026-02-17: disclosed: Initial disclosure to ChromaDB security team
- 2026-06-12: disclosed: Public disclosure via GitHub Advisory and HiddenLayer SAI Security Advisory
- 2026-06-12: advisory: CVE-2026-45830 published
- 2026-08-24: other: GitHub Advisory updated