The vulnerability in ChromaDB version 0.5.0 involves the SimpleRBACAuthorizationProvider authorization provider, which evaluates whether a user holds a given permission but fails to check the specific tenant, database, or collection to which that permission applies. This incorrect authorization (CWE-863) enables users with certain permissions to perform actions across tenants, potentially leading to unauthorized access or modification of data in other tenants' contexts. The CVSS 4.0 score is 8.8, indicating a high severity with network attack vector, low attack complexity, and partial privileges required. No official patch or remediation level has been published as of the data provided.

Users with permissions in one tenant can perform actions in other tenants due to missing tenant-level authorization checks. This can lead to unauthorized cross-tenant data access or modification, compromising tenant isolation and data confidentiality within ChromaDB environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for unusual cross-tenant activity. Avoid deploying version 0.5.0 in multi-tenant environments where strict tenant isolation is required.