CVE-2026-22663

Katalog CVE

CVSS 7.5 · High EPSS 0,28%

Kerentanan Missing Authorization pada fka prompts.chat. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

prompts.chat prior to commit 7b81836 contains multiple authorization bypass vulnerabilities due to missing isPrivate checks across API endpoints and page metadata generation that allow unauthorized users to access sensitive data associated with private prompts. Attackers can exploit these missing authorization checks to retrieve private prompt version history, change requests, examples, current content, and metadata including titles and descriptions exposed via HTML meta tags.

Rincian

Terbit di NVD

3 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/f/prompts.chat/pull/1104 issue tracking · patch · advisory vendor
• https://github.com/f/prompts.chat/commit/7b81836b214f2796aaf37ded2944eadc978afd35 patch
• https://www.vulncheck.com/advisories/prompts-chat-authorization-bypass-information-disclosure advisory pihak ketiga