CVE-2026-45832: Trychroma Chromadb

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

Affected products

• Trychroma Chromadb: from 0.5.0, up to and including 1.5.9

Published 2026-06-12. Last modified 2026-07-15.