Threats Tagged 'ghsa-p6ph-3jx2-3337'

OpenList v4 before 4.2.4 contains an authorization bypass and information disclosure vulnerability in its search API due to improper path prefix validation and unfiltered backend counting in the Bleve search engine. A low-privileged user can bypass BasePath restrictions to access metadata of files in unauthorized sibling directories and confirm the existence of sensitive files via the total count field. This defeats the intended namespace isolation and allows enumeration of hidden infrastructure and sensitive file metadata.