CVE-2026-102663 Details
Description
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.
A path containment authorization vulnerability has been identified in OpenList versions prior to 4.2.4. The issue arises in the search API when using the Bleve search engine, as it employs a non-separator-aware prefix comparison for path authorization checks. This flaw allows restricted users to access globally indexed results from unauthorized sibling paths, potentially leading to the disclosure of file metadata or the existence of files in those locations.
Users can update to OpenList version 4.2.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a | [email protected] | Source CodeVendor |
| https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679 | [email protected] | Source CodeVendor |
| https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4 | [email protected] | Release NotesVendor |
| https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenList | <= 4.2.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |