CVE-2026-22663: prompts.chat Auth Bypass Vulnerability

CVE-2026-22663 Overview

CVE-2026-22663 is an authorization bypass vulnerability affecting prompts.chat, a popular prompts management platform. The vulnerability exists in versions prior to commit 7b81836 and stems from multiple missing isPrivate checks across API endpoints and page metadata generation. This flaw allows unauthorized users to access sensitive data associated with private prompts, effectively bypassing the intended access control mechanisms.

Attackers can exploit these missing authorization checks to retrieve private prompt version history, change requests, examples, current content, and metadata including titles and descriptions exposed via HTML meta tags. This represents a significant information disclosure risk for organizations and individuals relying on the privacy features of the platform.

Critical Impact

Unauthorized access to private prompt data including version history, change requests, examples, content, and metadata through multiple broken access control endpoints.

Affected Products

• prompts.chat versions prior to commit 7b81836b214f2796aaf37ded2944eadc978afd35
• prompts.chat deployments without the security patch from PR #1104

Discovery Timeline

• 2026-04-03 - CVE-2026-22663 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-22663

Vulnerability Analysis

This vulnerability falls under CWE-862 (Missing Authorization), a critical flaw where the application fails to perform authorization checks before allowing access to protected resources. The prompts.chat application implements a privacy feature allowing users to mark prompts as private, but the authorization enforcement is inconsistent across multiple API endpoints and rendering functions.

The vulnerability manifests in several distinct areas of the application. API endpoints that serve prompt version history, change requests, and examples fail to verify the isPrivate flag before returning data. Additionally, page metadata generation for SEO purposes inadvertently exposes private prompt titles and descriptions through HTML meta tags, making this information accessible to anyone who can craft the appropriate request or view page source.

The network-accessible nature of these endpoints means that any unauthenticated attacker with knowledge of prompt identifiers can enumerate and extract private data without any credentials or special privileges.

Root Cause

The root cause of CVE-2026-22663 is the absence of consistent authorization checks across the application's API layer and server-side rendering components. While the application implements an isPrivate property on prompts, this flag is not consistently validated before data access operations are performed.

Specifically, the following areas lack proper authorization enforcement:

• Version history retrieval endpoints
• Change request viewing functionality
• Example prompt access APIs
• Current prompt content endpoints
• Server-side metadata generation for page rendering

This inconsistent application of access controls is a common pattern in web applications where security considerations are retrofitted rather than designed from the ground up.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication or user interaction. An attacker can directly access the vulnerable API endpoints by constructing HTTP requests with known or guessed prompt identifiers.

The exploitation flow involves:

1. Endpoint Enumeration: The attacker identifies accessible API routes that return prompt-related data
2. Identifier Discovery: Through enumeration or information disclosure in HTML meta tags, the attacker obtains valid prompt identifiers
3. Data Extraction: Direct API requests bypass the missing authorization checks, returning private prompt data
4. Metadata Harvesting: Page metadata exposed in HTML tags reveals additional private information such as prompt titles and descriptions

The vulnerability requires no special tools or techniques beyond basic HTTP request crafting, making it accessible to low-skilled attackers. For technical implementation details, refer to the security fix commit and the associated pull request.

Detection Methods for CVE-2026-22663

Indicators of Compromise

• Unusual access patterns to prompt-related API endpoints from unauthenticated sessions
• High volume of requests to version history, change request, or example endpoints
• Access to prompt metadata endpoints without corresponding user authentication events
• Enumeration patterns in prompt identifier parameters (sequential or predictable ID access)

Detection Strategies

• Implement logging and monitoring for all API endpoints that serve prompt-related data
• Alert on access to private prompt endpoints from sessions without authenticated user context
• Monitor for bulk data retrieval patterns that may indicate automated scraping
• Review web server logs for unusual access to metadata generation routes

Monitoring Recommendations

• Deploy web application firewall (WAF) rules to detect and block enumeration attempts
• Implement rate limiting on prompt-related API endpoints to slow down automated attacks
• Enable detailed audit logging for all prompt access operations including the privacy status
• Configure SIEM alerts for access control bypass patterns in application logs

How to Mitigate CVE-2026-22663

Immediate Actions Required

• Update prompts.chat to a version containing commit 7b81836b214f2796aaf37ded2944eadc978afd35 or later
• Review access logs for evidence of exploitation prior to patching
• Audit any private prompts that may have been exposed during the vulnerable period
• Notify affected users if unauthorized access to their private prompts is detected

Patch Information

The vulnerability has been addressed in the security fix commit. The patch implements consistent isPrivate checks across all affected API endpoints and page metadata generation functions.

Organizations running self-hosted instances of prompts.chat should pull the latest code from the repository and redeploy their applications. The fix is also documented in Pull Request #1104 which provides additional context on the changes.

For detailed advisory information, refer to the VulnCheck Advisory.

Workarounds

• Restrict network access to prompts.chat instances to trusted users only until patching is complete
• Implement a reverse proxy or API gateway with additional authorization checks for prompt-related endpoints
• Temporarily disable public access to the application if sensitive private prompts are at risk
• Consider removing or redacting sensitive content from private prompts until the fix is deployed

# Configuration example - Restrict access via nginx until patch is applied
# Add to nginx server block for prompts.chat
location ~* ^/api/(prompts|versions|changes|examples) {
    # Require authentication for all prompt-related endpoints
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://prompts_backend;
}