HIGH 8.8
GHSA-xph7-9rjv-w5fr
ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to
Details
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI / chromadb
Introduced in:
0.5.0 No fixed version published yet for chromadb (pip). Pin to a known-safe version or switch to an alternative.