SEC.co
Emergency

By weakness (CWE)

CWE-551: related vulnerabilities

CVEs classified under CWE-551. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-45832HIGH 8.8

    ChromaDB's Python implementation contains an authorization bypass vulnerability affecting its V1 collection-level API endpoints. When users interact with collections through V1 endpoints, the system fails to properly pass tenant and database identifiers to its authorization layer, effectively disabling access controls. An authenticated attacker can exploit this to access collections they should not have permission to view or modify. The vulnerability requires valid credentials but allows attackers to escalate privileges within the ChromaDB instance.