CVE-2026-92782
Chroma through 1.5.9 Authorization Bypass via Collection Identifier
- State
- Published
- Severity
- 8.6 High
- Published
- Sep 16, 2026
- Updated
- Sep 19, 2026
- Reserved
- Sep 16, 2026
Description
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
chromachroma-core |
|
References
- GitHub Issue #7462issue-tracking
- https://github.com/chroma-core/chromaproduct
- the shared collection auth helper resolves the collection before checking the pathtechnical-description
- the provider caches and returns by collection id without comparing the databasetechnical-description
- VulnCheck Advisory: Chroma through 1.5.9 Authorization Bypass via Collection Identifierthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.