THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-92782 (HIGH 8.1) — Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by

[NVD] CVE-2026-92782 (HIGH 8.1) — Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by

mednvdPublished 2026-09-16

CVE-2026-92782 CVSS: 8.1 HIGH Published: 2026-09-16T21:17:27.280

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassi

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-92782