In ChromaDB Python project version 0.5.0, all V1 collection-level endpoints fail to properly enforce authorization because they pass None values for tenant and database to the authorization layer. This allows attackers with limited privileges to bypass authorization checks by exploiting these V1 endpoints, effectively gaining unauthorized access to resources. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 4.0 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, and no user interaction required. No official patch or remediation guidance has been published yet, and no known exploits are reported in the wild.

Attackers can bypass authorization controls on V1 collection-level endpoints in ChromaDB Python project version 0.5.0, potentially gaining unauthorized access to data or functionality that should be restricted. This compromises the confidentiality and integrity of the affected system. The vulnerability requires low privileges to exploit and can be triggered remotely without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the V1 collection-level endpoints or implement additional access controls outside the affected authorization layer to mitigate unauthorized access risks.