CVE-2026-22663 f CVE debrief

Who should care

Users of Prompts.chat prior to commit 7b81836 should apply the patch to prevent unauthorized access to sensitive data. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that access controls are in place and that the patch is applied. Additionally, users should review their current access controls for API endpoints and page metadata generation to prevent similar vulnerabilities in the future.

Technical summary

The vulnerability exists due to missing authorization checks in Prompts.chat, allowing attackers to retrieve private prompt version history, change requests, examples, current content, and metadata. The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. The missing isPrivate checks across API endpoints and page metadata generation enable unauthorized access to sensitive data associated with private prompts.

Defensive priority

High

Recommended defensive actions

• Apply the patch at commit 7b81836
• Review and update access controls for API endpoints and page metadata generation
• Monitor for unauthorized access to sensitive data
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by an unknown source and patched by the vendor. The NVD entry is currently Analyzed. Evidence is limited, and defenders should verify the patch and review access controls for API endpoints and page metadata generation. The CVE record was published on 2026-04-03T21:17:09.337Z and has not been modified since then.

Official resources