The vulnerability in OpenList's search API arises from two logic flaws when using the Bleve search engine: (1) an insecure path prefix check using strings.HasPrefix without path-separator awareness allows a user restricted to a BasePath (e.g., /base) to access sibling directories with similar prefixes (e.g., /base2), bypassing authorization; (2) the Bleve backend returns a global total count of matching files ignoring the BasePath boundary, enabling blind enumeration of unauthorized files even if metadata access is filtered later. This combination leads to information disclosure and horizontal/vertical privilege escalation by exposing metadata and existence of files outside the user's authorized namespace.

Any authenticated user with low privileges can bypass BasePath restrictions to discover and access metadata of files in unauthorized directories. They can also confirm the existence of sensitive files through the unfiltered total count returned by the search backend. This compromises confidentiality by leaking file metadata and enables enumeration of hidden infrastructure, defeating the BasePath isolation mechanism.

No official patch or fix is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Recommended mitigations include replacing the insecure strings.HasPrefix path check with a separator-aware containment check (e.g., verifying that the target path equals the base path or starts with base path plus a path separator), enforcing path boundaries within the Bleve query itself rather than relying on post-query filtering, and calculating the total count only after applying all authorization and path filters to prevent leakage of unauthorized file existence information.