The vulnerability CVE-2026-22663 in prompts.chat arises from missing authorization checks (CWE-862) on private prompt data. Specifically, the application fails to verify the isPrivate status across various API endpoints and in the generation of page metadata. This omission enables attackers without any privileges to retrieve sensitive information associated with private prompts, including their version history, change requests, examples, current content, and metadata exposed through HTML meta tags. The CVSS 4.0 base score is 8.7, reflecting a high severity due to network attack vector, no required privileges or user interaction, and high impact on confidentiality. No patch or official remediation guidance is currently available, and the product is not a cloud service, so remediation depends on the vendor releasing a fix.

Unauthorized users can access sensitive private prompt data that should be restricted, including version histories, change requests, examples, current content, and metadata. This exposure can lead to confidentiality breaches of potentially sensitive or proprietary information stored in private prompts. There is no indication of integrity or availability impact. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to the affected versions or disabling the vulnerable functionality may reduce risk. No vendor advisory states that no action is required or that the issue is mitigated.