chroma-core CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH chroma-core CVE published 2026-09-16

CVE-2026-92782

CVE-2026-92782 debrief: Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. This vulnerability enables attackers to read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks. [truncated]