Path Containment Authorization Flaw in OpenList by OpenListTeam

CVE-2026-102663

What is CVE-2026-102663?

The OpenList application, which supports various storage backends, contains a vulnerability in its search API prior to version 4.2.4. This issue arises from a failure in properly validating path containment for authorized access, specifically during searches conducted by restricted authenticated users against a globally indexed database. The flawed implementation allows a user to access unauthorized file metadata or file existence information, particularly when searching sibling paths that share a common base. As a result, even if certain access controls are applied to restrict access to sensitive information, unauthorized data may still be exposed due to incorrect prefix checks. This vulnerability has been addressed in version 4.2.4, which should be implemented to mitigate the risk.

References