CVE-2026-45832
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing at
CVSS
8.8
Alto
EPSS
0.3%
p21
KEV
—
Exploit Today
6
0-100
Publicado: 12 jun 2026 · Última mod.: 15 jul 2026 · CWE-639 · CWE-551
0.3%EPSS · 30 días0.3%
2026-08-082026-09-05
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.
- www.hiddenlayer.comhttps://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-4
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-45832
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2488411
- security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45832.json
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-861835.3 MED—
——0A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widget_id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the patch is 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.15hCVE-2026-163109.8 CRÍ—
——0The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.21hCVE-2026-861926.5 MED—
——0SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization.1dCVE-2026-861914.3 MED—
——0SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.1dCVE-2026-861764.3 MED—
——0NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.2dCVE-2026-861744.3 MED—
——0Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.2d