{"id":"EUVD-2026-97775","enisaUuid":"1f89032c-622d-3648-a8ef-b742262c3b59","description":"OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user\u0027s BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.","datePublished":"Oct 12, 2026, 6:49:23 PM","dateUpdated":"Oct 13, 2026, 4:01:30 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337\nhttps://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a\nhttps://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679\nhttps://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4\n","aliases":"CVE-2026-102663\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"b0915f04-0885-3c09-a63d-8260ff96aa81","product":{"name":"OpenList","vendor":{"name":"OpenListTeam"}},"product_version":"\u003c 4.2.4"}],"enisaIdVendor":[{"id":"493d2711-8caf-3776-937d-57bd6b342ddd","vendor":{"name":"OpenListTeam"}}],"enisaIdVulnerability":[{"id":"39c4c434-111c-33a6-aa5d-64c8d0ee8390","vulnerability":{"id":"CVE-2026-102663","description":"OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user\u0027s BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.","datePublished":"Oct 12, 2026, 6:49:23 PM","dateUpdated":"Oct 13, 2026, 4:01:30 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337\nhttps://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a\nhttps://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679\nhttps://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4\n","enisa_id":"EUVD-2026-97775\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Nov 2, 2026, 7:16:06 AM","vulnerabilityProduct":[{"id":"0ddec5dc-5f79-31b4-9dd8-fbb00b6dc937","product":{"name":"OpenList","vendor":{"name":"OpenListTeam"}},"product_version":"\u003c 4.2.4"}],"vulnerabilityVendor":[{"id":"560b807d-65e0-30df-a51a-91fc1be6d8cb","vendor":{"name":"OpenListTeam"}}]}}],"enisaIdAdvisory":[]}