OpenListTeam OpenList up to 4.2.3 Search API strings.HasPrefix improper authorization

Summaryinfo

A vulnerability was found in OpenListTeam OpenList up to 4.2.3. It has been declared as problematic. The affected element is the function strings.HasPrefix of the component Search API. The manipulation results in improper authorization. This vulnerability is reported as CVE-2026-102663. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in OpenListTeam OpenList up to 4.2.3. It has been classified as problematic. Affected is the function strings.HasPrefix of the component Search API. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. CVE summarizes:

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-102663 since 09/29/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 4.2.4 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• OpenListTeam

Name

• OpenList

Version

• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3

Website

• Product: https://github.com/OpenListTeam/OpenList/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion