CVE-2026-92782CWE-863broken-access-control

CVE-2026-92782

High · published September 17, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00448 · 37.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-17T01:17Z
References (6)
https://github.com/chroma-core/chroma · [email protected]https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/get_collection_with_segments_provider.rs#L143-L160 · [email protected]https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/server.rs#L469-L487 · [email protected]https://github.com/chroma-core/chroma/issues/7462 · [email protected]https://www.vulncheck.com/advisories/chroma-through-1.5.9-authorization-bypass-via-collection-identifier · [email protected]https://github.com/chroma-core/chroma/issues/7462 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 20:32Z
    Chroma through 1.5.9 Authorization Bypass via Collection Identifier
    cvelistv5