CVE-2026-102663: OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenListto a version that resolves this vulnerability.Fixed in 4.2.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with a restricted BasePath can exploit it if Bleve search is enabled and the application uses the global search index. The user must be able to submit searches through the OpenList search API.
What information can be exposed?
A user may obtain metadata or file-existence information for content in a sibling path whose name shares the restricted BasePath prefix, such as /base2 when their allowed path is /base. Even if a separate access check removes an individual result, the backend Total value can disclose that a matching item exists.
Are unrestricted users or installations without Bleve search affected?
The described authorization bypass applies to restricted authenticated users searching globally indexed Bleve results. The issue requires Bleve search to be enabled; the provided information does not indicate exposure for installations where it is not enabled.
What version fixes the issue?
OpenList version 4.2.4 fixes the issue. Versions prior to 4.2.4 are affected under the described Bleve global-search and restricted-BasePath conditions.