Is CVE-2026-22663 actively exploited?

No active exploitation of CVE-2026-22663 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-22663 be exploited remotely?

Yes. CVE-2026-22663 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-22663?

CVE-2026-22663 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-22663

HIGH

CVE-2026-22663

CWE-862Published: April 3, 2026· Updated: Apr 7, 2026

7.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.5th

Official Description

prompts.chat prior to commit 7b81836 contains multiple authorization bypass vulnerabilities due to missing isPrivate checks across API endpoints and page metadata generation that allow unauthorized users to access sensitive data associated with private prompts. Attackers can exploit these missing authorization checks to retrieve private prompt version history, change requests, examples, current content, and metadata including titles and descriptions exposed via HTML meta tags.

NVD Source

Technical Analysis

CVE-2026-22663 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.