The vulnerability identified as CVE-2026-45830 affects ChromaDB Python project starting from version 0.4.17. It is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-266 (Incorrect Access Control). Due to insufficient authorization checks, authenticated users can perform arbitrary data operations on collections belonging to other tenants, violating tenant isolation. The CVSS 4.0 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No official patch or remediation level is currently provided by the vendor. The Red Hat advisory linked does not specify a fix or mitigation, and no known exploits are reported in the wild.

Successful exploitation allows any authenticated user to bypass tenant boundaries and perform unauthorized read, write, update, or delete operations on data belonging to other tenants. This compromises data confidentiality, integrity, and availability across tenant collections within ChromaDB. The impact is high due to the broad scope of unauthorized access and modification capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is indicated in the vendor advisory, users should monitor the vendor's security advisories for updates. Until a patch is available, restrict authenticated user privileges where possible and consider additional access control mechanisms external to ChromaDB to enforce tenant isolation.