The flaw causes every V1 collection‑level endpoint in the ChromaDB Python client to forward a null tenant and database to the authorization logic. This omission enables an attacker who can reach the API to invoke any V1 endpoint and gain access to data or perform operations that are normally protected by tenant or database boundaries. The vulnerability is an instance of CWE‑639, where required authorization checks are omitted, allowing unauthorized read or write capabilities.

Chroma: ChromaDB’s Python project, specifically all V1 collection‑level endpoints. The affected product is the current release of the Python client; version details were not supplied in the advisory.

The CVSS score of 8.8 classifies the issue as high severity, and the EPSS score of <1% indicates a low likelihood of exploitation, though the lack of a CISA KEV listing does not mitigate the intrinsic risk. Attackers can exploit the flaw by sending standard API requests to the V1 endpoints, bypassing tenant and database restrictions without needing authentication or elevated privileges. The impact covers confidentiality, integrity, and availability of tenant‑isolated data, potentially affecting all users of the service.