CVE-2026-102663: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in OpenListTeam OpenList

OpenList's search API prior to version 4.2.4 uses a strings.HasPrefix comparison to authorize access to globally indexed Bleve search results against a restricted user's BasePath. This check is not separator-aware, causing sibling paths (e.g., /base2) to be incorrectly considered as contained within the BasePath (e.g., /base). As a result, restricted authenticated users can obtain unauthorized file metadata or file-existence information from sibling paths. Additionally, the backend Total value may reveal matches even if individual results are filtered out by other access controls. This vulnerability is classified as CWE-200 (Exposure of Sensitive Information) and CWE-639 (Authorization Bypass Through User-Controlled Key). The issue is fixed in OpenList version 4.2.4.

An attacker with restricted authenticated access can gain unauthorized exposure to sensitive file metadata and existence information from sibling paths outside their authorized BasePath. This information disclosure does not allow modification or deletion of data but can reveal the presence of files and search result counts that should be inaccessible. The CVSS score is 4.3 (medium severity), reflecting limited confidentiality impact without integrity or availability effects.

Upgrade OpenList to version 4.2.4 or later, where the issue is fixed. Prior to upgrading, no other vendor-provided mitigations are documented. Patch status is confirmed fixed in 4.2.4.