{"id":"EUVD-2026-97775","revision":"e9647b963a0b4d6bbcd95cdb2f727220","records":[{"revision":"e9647b963a0b4d6bbcd95cdb2f727220","observedAt":"2026-11-07T04:27:07.758+00:00","statement":{"source":"euvd","id":"EUVD-2026-97775","aliases":["CVE-2026-102663"],"title":"OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally ind…","description":"OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":null}],"references":["https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337","https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a","https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679","https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-97775","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 12, 2026, 6:49:23 PM","dateUpdated":"Oct 13, 2026, 4:01:30 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-97775","identifiers":["EUVD-2026-97775","CVE-2026-102663"]},"retained":false,"historicalAffected":[]}],"coverage":[]}