CVE-2026-92782
Chroma through 1.5.9 Authorization Bypass via Collection Identifier
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks.
| CWE | CWE-863 |
| Vendor | chroma-core |
| Product | chroma |
| Published | Sep 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for chroma-core chroma
Be the first to know when new high vulnerabilities affecting chroma-core chroma are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
chroma-core / chroma
0 ≤ 1.5.9
References
github.com: https://github.com/chroma-core/chroma/issues/7462 github.com: https://github.com/chroma-core/chroma github.com: https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/server.rs#L469-L487 github.com: https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/get_collection_with_segments_provider.rs#L143-L160 vulncheck.com: https://www.vulncheck.com/advisories/chroma-through-1.5.9-authorization-bypass-via-collection-identifier
Credits
George Chen