https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T12:38:37.153830+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-326913 EUVD-2026-326913 2026-10-02T12:38:37.217387+00:00 EUVD-2026-326913 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45831 fkie_cve-2026-45831 2026-10-02T12:38:37.217422+00:00

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.

 https://cve.radiocsirt.org/vuln/ghsa-xph7-9rjv-w5fr GHSA-xph7-9rjv-w5fr — ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to 2026-10-02T12:38:37.217456+00:00

Affected: PyPI: chromadb

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.

 https://cve.radiocsirt.org/vuln/pysec-2026-3815 PYSEC-2026-3815 — ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to 2026-10-02T12:38:37.217481+00:00

Affected: PyPI: chromadb

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.