Description
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.
Published: 2026-10-12
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Information Disclosure
Action: Apply Patch
AI Analysis

Impact

OpenList uses a non‑separator‑aware prefix comparison to authorize global Bleve search results against a user’s BasePath. An attacker with a restricted authenticated session can craft a query that returns results from a sibling path, causing the prefix check to succeed. The vulnerability allows disclosure of file metadata, existence, and total count values that belong to other base paths. This results in a confidentiality breach of information that should be confidential to the user’s own directory.

Affected Systems

The issue impacts OpenListTeam’s OpenList product in all releases prior to version 4.2.4. Any deployment running an older version and utilizing global Bleve search is vulnerable.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate risk. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be an authenticated, restricted user able to invoke the search API; no unauthenticated access is required. The attack surface is therefore limited to users with legitimate credentials, but the impact remains the unintended disclosure of sensitive metadata.

Generated by OpenCVE AI on October 12, 2026 at 20:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update OpenList to version 4.2.4 or newer, which contains the path‑authorization fix.
  • If an update cannot be applied immediately, disable the global Bleve search feature or restrict its use to privileged users only to prevent unauthorized path containment checks.
  • Ensure that any custom authentication or authorization logic explicitly validates BasePath boundaries using separator‑aware path comparison rather than a simple prefix function to avoid similar authorization bypasses.

Generated by OpenCVE AI on October 12, 2026 at 20:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Openlistteam
Openlistteam openlist
Vendors & Products Openlistteam
Openlistteam openlist

Mon, 12 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.
Title OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
Weaknesses CWE-200
CWE-639
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Openlistteam Openlist
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-13T16:01:30.361Z

Reserved: 2026-09-29T15:56:02.102Z

Link: CVE-2026-102663

cve-icon Vulnrichment

Updated: 2026-10-13T16:01:19.527Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T19:16:36.190

Modified: 2026-10-13T17:17:14.363

Link: CVE-2026-102663

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T21:15:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-639

    Authorization Bypass Through User-Controlled Key