Description
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Chroma | ChromaDB | 0.5.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | chromadb | >= 0.5.0, <= 1.5.9 | — | GHSA-xph7-9rjv-w5fr |