CVE-2026-102663

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.

• CWE-200
• CWE-639

• https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a
• https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679
• https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4
• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337
• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337

Published

Oct 12, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102637A maliciously crafted HTML payload in the documentName param…7.1
• CVE-2026-102638A maliciously crafted HTML payload in the description of an …7.1
• CVE-2026-102639MobilityDB version 1.3.0 and earlier contains an out-of-boun…6.5
• CVE-2026-10264A vulnerability was determined in lharries whatsapp-mcp 0.0.…3.5
• CVE-2026-102649Burrito is a Terraform Automation Collaboration Software (TA…9.9
• CVE-2026-10265A vulnerability was identified in itsourcecode Content Manag…6.3
• CVE-2026-102666The Joyland AI app contains hard-coded credentials for the G…6.5
• CVE-2026-102667Joyland AI app allows an attacker with shared network access…8.3
• CVE-2026-102668The Joyland AI app accepts any TLS certificates from any ser…5.3
• CVE-2026-102669Joyland AI app does not verify hostnames, allowing a malicio…5.3
• CVE-2026-10267A security flaw has been discovered in janet-lang janet up t…3.3
• CVE-2026-102670Joyland AI app explicitly permits cleartext HTTP traffic on …4.3