A missing authorization check in ChromaDB version 0.4.17 and newer allows any authenticated user to read, write, update, or delete data in any tenant’s collection, regardless of the tenant to which the user actually belongs. The flaw enables an attacker who only needs valid credentials to compromise confidentiality, integrity, and availability of data across all tenants.

Chroma: ChromaDB, versions 0.4.17 and newer are affected.

The CVSS score of 8.8 indicates a high‑severity vulnerability. While the EPSS score is not available, the lack of the KEV listing does not diminish the risk; an authenticated attacker can immediately exploit the flaw to manipulate data across tenants. Attackers can leverage any authentication mechanism offering valid credentials—such as username/password combinations or tokens—to perform the unauthorized operations, making the flaw easily exploitable in environments where credential management or tenant isolation controls are weak.