The vulnerability in chroma-core chroma through version 1.5.9 arises from failure to validate tenant and database segments during collection resolution. Authenticated attackers who know a collection identifier can access collections from other tenants. This unauthorized access enables them to read, modify, and update records in foreign collections by issuing requests under their own tenant path, effectively bypassing authorization checks. The CVSS 4.0 score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required beyond authentication, and high impact on confidentiality and integrity.

Exploitation of this vulnerability allows an authenticated attacker to bypass authorization controls and access collections belonging to other tenants. The attacker can read sensitive data, modify, and update records in these foreign collections, potentially leading to data breaches, data corruption, and unauthorized data manipulation across tenant boundaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious activity involving cross-tenant collection access. Avoid sharing collection identifiers and consider additional access controls at the application layer.