The vulnerability is caused by missing authorization checks in several API endpoints and during the generation of page metadata in prompts.chat. This allows unauthenticated or improperly authenticated users to access information that is intended to be private, such as prompt version history, change requests, examples, current content, titles and descriptions that are rendered as HTML meta tags. The weakness is an authorization bypass that permits information disclosure, classified as CWE-862.

The flaw affects the prompts.chat web platform in all releases preceding commit 7b81836. Users who rely on the public interface of the service are at risk if the application is not isolated within a secure network. No specific version strings are listed in the advisory, so any publicly available release before the patch is considered vulnerable.

The CVSS base score of 8.7 indicates a high severity for confidentiality impacts. The EPSS score is below 1 %, suggesting a low current exploitation probability, and the vulnerability is not yet captured in the CISA KEV catalogue. Exploitation is likely achievable by issuing simple HTTP requests to the exposed API endpoints or by accessing a private prompt page, at which point the unauthorized data is returned or embedded in the page’s HTML. The attack path requires no special privileges beyond an unauthenticated or poorly authenticated user.