CVE-2026-92782 | BDVDB-2026-375495 Detail
chroma-corechroma
Description#
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-863 Incorrect Authorization
References#
- https://github.com/chroma-core/chroma/issues/7462
- https://github.com/chroma-core/chroma
- https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/server.rs#L469-L487
- https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/get_collection_with_segments_provider.rs#L143-L160
- https://www.vulncheck.com/advisories/chroma-through-1.5.9-authorization-bypass-via-collection-identifier
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.