Approved changes feed: RSS · Atom
cpe:2.3:a:chroma:chromadb:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Chroma (8720931e-0cd9-55b2-b7f8-7a9dcd481a21) |
|---|---|
| Product | Chromadb (79b9b075-0e76-5560-89dc-af6105ae5782) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-8828 |
vulnerable | 2026-07-29 01:09:06.301005 |
Details available
A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.
Published: 2026-06-12T14:50:32.788Z
Updated: 2026-06-12T16:00:39.467Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45833 |
vulnerable | 2026-07-29 00:54:58.585959 |
Details available
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.
Published: 2026-06-12T15:16:33.238Z
Updated: 2026-07-31T12:04:48.240Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45832 |
vulnerable | 2026-07-29 00:54:58.585826 |
Details available
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.
Published: 2026-06-12T15:11:46.697Z
Updated: 2026-07-31T12:04:47.882Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45831 |
vulnerable | 2026-07-29 00:54:58.585587 |
Details available
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.
Published: 2026-06-12T15:03:58.841Z
Updated: 2026-06-12T16:22:00.578Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45830 |
vulnerable | 2026-07-29 00:54:58.585327 |
Details available
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.
Published: 2026-06-12T14:46:54.823Z
Updated: 2026-07-31T12:04:49.361Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45829 |
vulnerable | 2026-06-08 08:05:11.876717 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.