A missing authorization check in ChromaDB version 0.4.17 and newer allows any authenticated user to read, write, update, or delete data in any tenant’s collection, regardless of the tenant to which the user actually belongs. The flaw enables an attacker who only needs valid credentials to compromise confidentiality, integrity, and availability of data across all tenants.

Chroma: ChromaDB, versions 0.4.17 and newer are affected.

The CVSS score of 8.8 indicates a high‑severity vulnerability. The EPSS score of 0.00038, representing less than 1% exploitation probability, indicates that the vulnerability is less likely to be exploited, but it does not diminish the risk posed by the high severity; an authenticated attacker can still immediately manipulate data across tenants. Attackers can leverage any authentication mechanism offering valid credentials—such as username/password combinations or tokens—to perform the unauthorized operations, making the flaw easily exploitable in environments where credential management or tenant isolation controls are weak.