CVE-2026-22663
Authorization Bypass in prompts.chat Exposes Private Prompt Data
Publication date: 2026-04-03
Last updated on: 2026-04-13
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fka | prompts.chat | to 2026-03-25 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized users to access sensitive data associated with private prompts due to missing authorization checks. Such unauthorized access to sensitive information could potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive data.
However, specific impacts on compliance with these standards are not detailed in the provided information.
Can you explain this vulnerability to me?
This vulnerability exists in prompts.chat prior to commit 7b81836 and involves multiple authorization bypass issues. Specifically, missing isPrivate checks across API endpoints and page metadata generation allow unauthorized users to access sensitive data related to private prompts.
Attackers can exploit these missing authorization checks to retrieve private prompt version history, change requests, examples, current content, and metadata such as titles and descriptions that are exposed via HTML meta tags.
How can this vulnerability impact me? :
The impact of this vulnerability is that unauthorized users can gain access to sensitive and private information that should be restricted. This includes private prompt version histories, change requests, examples, current content, and metadata.
Such unauthorized access can lead to information disclosure, potentially compromising confidentiality and privacy of data that users expect to remain private.