HIGH

CVE-2026-92782

2026-09-16 CVSS v3.1

CVSS

8.1

Description

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks.

Weakness (CWE)

CWE-863 Incorrect Authorization

EPSS Score

0.25%

Probability of exploitation in next 30 days

16.8th percentile

References

https://github.com/chroma-core/chroma https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/get_collection_with_segments_provider.rs#L143-L160 https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/server.rs#L469-L487 https://github.com/chroma-core/chroma/issues/7462 https://www.vulncheck.com/advisories/chroma-through-1.5.9-authorization-bypass-via-collection-identifier

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE