CVEvulnerability
CVE-2026-92782
8.6 HIGH
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-09-16
- Last modified
- 2026-09-24
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-863
Description
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks.
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://github.com/chroma-core/chroma github.com
- https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/get_collection_with_segments_provider.rs#L143-L160 github.com
- https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/server.rs#L469-L487 github.com
- https://github.com/chroma-core/chroma/issues/7462 github.com
- https://www.vulncheck.com/advisories/chroma-through-1.5.9-authorization-bypass-via-collection-identifier www.vulncheck.com
- https://github.com/chroma-core/chroma/issues/7462 github.com