Cyber Resilience

CVE-2026-45830

HighUpdated

Published: 12 June 2026

Published
12 June 2026
Modified
30 June 2026
KEV Added
—
Patch
—
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0034 26.4th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-45830 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Trychroma Chromadb. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 26.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access ControlA06:2025 Insecure Design

EU & UK References

Vulnerability details

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

CWE(s)
CWE-639CWE-266

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

Authz bypass (CWE-639) in multi-tenant DB directly enables privilege escalation to unauthorized tenant data and direct access to database collections.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

trychroma
chromadb
0.4.17 — 1.5.9

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-1 Policy and Procedures
addresses: CWE-266

Designation of a manager and policy dissemination ensures privileges are assigned according to defined roles.

AC-13 Supervision and Review — Access Control
addresses: CWE-266

Regular reviews catch incorrect privilege assignments to users, roles, or processes.

AC-2 Account Management
addresses: CWE-266

Explicitly specifying privileges and group/role memberships for accounts reduces the risk of incorrect privilege assignments.

AC-24 Access Control Decisions
addresses: CWE-639

Per-request decision making makes it harder to bypass authorization using user-controlled keys without proper validation in the decision process.

AC-3 Access Enforcement
addresses: CWE-639

Consistent enforcement of approved authorizations makes bypassing via user-controlled keys ineffective.

AC-5 Separation of Duties
addresses: CWE-266

The control requires explicit definition of separated access authorizations, making incorrect privilege assignments that bundle conflicting duties harder to implement.

AC-6 Least Privilege
addresses: CWE-266

Ensures privileges are assigned only as necessary rather than incorrectly over-granted.

References