{"id":"CVE-2026-102663","title":"OpenList is a file list program that supports multiple storage backends","summary":"OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally …","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-200","CWE-639"],"vendor":"OpenListTeam","product":"github.com/OpenListTeam/OpenList/v4","affected":["github.com/OpenListTeam/OpenList/v4 < 4.2.4"],"patched":["github.com/OpenListTeam/OpenList/v4 4.2.4"],"published":"2026-10-12","updated":"2026-10-13","sourceUpdated":"2026-10-13T17:17:14.363","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102663","references":[{"url":"https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a","label":"security-advisories@github.com"},{"url":"https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679","label":"security-advisories@github.com"},{"url":"https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4","label":"security-advisories@github.com"},{"url":"https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337","label":"security-advisories@github.com"},{"url":"https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/OpenListTeam/OpenList"}],"tags":["nvd","osv","go","cve.org","exploit-available"],"epss":0.0026,"epssPercentile":0.1757,"aliases":["GHSA-p6ph-3jx2-3337","GO-2026-6113"],"ecosystem":"go","ingestedAt":"2026-10-12T20:03:12.348Z","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-13T16:00:59.279006Z"},"slug":"CVE-2026-102663","body":"## Overview\n\nOpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-102663)\n\nAffected packages:\n\n- `github.com/OpenListTeam/OpenList/v4 < 4.2.4`\n\nPatched in:\n\n- `github.com/OpenListTeam/OpenList/v4 4.2.4`\n\nSource: https://osv.dev/vulnerability/GHSA-p6ph-3jx2-3337","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":220975,"id":"CVE-2026-102663","ts":1792026948361,"field":"exploit_available","old":"false","new":"true"}]}