The vulnerability arises when prompts.chat treats usernames inconsistently: writes are case-sensitive while reads are case-insensitive, enabling an attacker to register an account that differs only by letter case. This case‑variant account passes uniqueness checks and later resolves to the same canonical username. Consequently, an attacker can impersonate an existing user, replace that user's profile data, and insert malicious metadata on public URLs. Such actions compromise confidentiality and integrity of user accounts and the overall platform content.

All versions of prompts.chat before the change that normalizes username handling are vulnerable. The fix was introduced in commit 1464475 of the prompts.chat source repository. The affected product is the prompts.chat web application hosted by fka.

The CVSS base score of 8.6 marks this issue as high severity. The EPSS score of less than 1% indicates that, while the vulnerability can be exploited easily, the likelihood of exploitation in the wild is currently low. Because it is not listed in the CISA KEV catalog, there is no evidence of known exploitation yet. An attacker can reach the vulnerability remotely by creating a crafted username through the registration or account‑management interfaces, after which the attacker can access or modify data as the victim. Given the severity and ease of exploitation, organizations should prioritize remediation, especially those that expose the service to the public internet.