The vulnerability CVE-2026-45832 in ChromaDB's Python project involves the V1 collection-level endpoints passing None values for tenant and database parameters to the authorization layer. This improper handling allows attackers with limited privileges to bypass authorization controls by exploiting these endpoints. The issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-551 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The CVSS 4.0 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability affects version 0.5.0 of ChromaDB. The vendor advisory from Red Hat does not provide explicit remediation or patch information.

Successful exploitation of this vulnerability allows an attacker with limited privileges to bypass authorization controls on the V1 collection-level endpoints of ChromaDB, potentially leading to unauthorized access or operations within the affected system. This could compromise data confidentiality and integrity within the affected version 0.5.0 of ChromaDB.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is provided by the vendor advisory, users should monitor the vendor's security advisories for updates. Until a patch is available, restrict access to the vulnerable endpoints and consider disabling or limiting use of the V1 collection-level endpoints if feasible.