CVE-2026-45831: The SimpleRBACAuthorizationProvider authorization provider in versions 0

Synopsis

An authorization-logic flaw in the SimpleRBACAuthorizationProvider component of ChromaDB (versions 0.5.0 and later) allows an authenticated low-privilege user to bypass tenant, database, and collection boundaries. The vulnerability is reachable over the network and requires only a valid low-privilege account; no victim interaction is needed. Successful exploitation lets an attacker read or modify data belonging to other tenants or collections they have no legitimate access to. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ChromaDB service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is involved.

• AuthenticationRequired

  A low-privilege account is sufficient; the CVSS vector specifies PR:L, so any valid ChromaDB user credential meets the bar.

• Victim interactionNot required

  No action is needed from another user or administrator; the CVSS vector specifies UI:N.

• Attack complexityDetail

  Base exploit conditions are straightforward (AC:L), though the CVSS vector notes AT:P, meaning a specific deployment configuration or timing condition must be present for the attack to succeed reliably.

Blast Radius

• An attacker reads collection contents, embeddings, and metadata belonging to other tenants they have no legitimate access to (VC:H).
• An attacker writes to, overwrites, or deletes records and collections owned by other tenants or databases (VI:H, SI:H).
• Cross-scope permission abuse extends to system-level collection and database resources beyond the attacker's own tenant boundary (SC:H).
• Service availability for the affected component is not directly impacted by this vulnerability (VA:N, SA:N).