A missing authorization check in ChromaDB versions 1.0.0 and later permits any authenticated user to read, write, update, or delete data in any tenant’s collection regardless of their own tenant membership. The flaw therefore enables complete compromise of data confidentiality, integrity and availability for all tenants sharing the same deployment.

The affected product is ChromaDB, version 1.0.0 or newer, supplied by Chroma. No specific sub‑versions are listed in the CNA data; any release in the 1.x series inherits the vulnerability.

The CVSS score of 8.8 indicates a high severity vulnerability. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog, so the current exploitation probability is unknown. The likely attack vector requires authentication, meaning any victim user account can exploit the flaw. Once authenticated, an attacker can exfiltrate or poison data for other tenants, potentially leading to loss of trust, regulatory breach, or service disruption if key data is manipulated. The absence of proven exploits suggests a moderate to high risk given the vulnerability’s severity and the ease of exploitation once credentials are obtained.