CyberRota Analysis
AI-GeneratedChroma versions up to 1.5.9 are vulnerable due to inadequate validation of tenant and database segments, enabling authenticated attackers to access and manipulate collections belonging to other tenants by exploiting known collection identifiers. This flaw allows unauthorized reading, modification, and updating of records, effectively bypassing intended authorization controls. Organizations utilizing Chroma should prioritize patching this vulnerability to mitigate the risk of data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks.