Vendor
Chroma
6 known vulnerabilities.
Products
4 results · Clear filters · Feed
-
High 8.8
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorizati…
-
High 8.8
ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing u…
-
High 8.8
A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated user…
-
High 8.8
ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.