OpenList CVE-2026-102663

Exploitation requires: (1) the admin-configured Bleve search index mode to be enabled and the index built - the flaw lives in the Bleve search path (internal/search/bleve/search.go and server/handles/search.go); (2) an authenticated low-privileged user account whose BasePath is restricted (PR:L); and (3) a sensitive sibling directory whose name shares the victim's BasePath as a string prefix (e.g. BasePath /base and target /base2), so the non-separator-aware strings.HasPrefix check mis-authorizes it. Limiting factors that reduce real-world risk: authentication is mandatory, the Bleve engine is not the universal default, the exploitable condition hinges on specific sibling-directory naming, and disclosure is limited to file metadata/existence and the backend Total match count rather than full file contents (though metadata may be returned directly if folder-level passwords are not set).

This is a genuine but low-to-medium priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3 Medium) is internally consistent with the description and GHSA advisory: a network-reachable but authenticated (PR:L) low-privileged user can trigger it with no user interaction, and impact is limited to low confidentiality (C:L) with no integrity or availability effect - matching CWE-200 information disclosure. A detailed proof-of-concept is published in the GHSA advisory, so publicly available exploit code exists; however, there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The signals do not conflict, but they are modest across the board: the flaw only leaks file metadata and existence/Total-count information (not file contents directly), requires an already-authenticated restricted user, and depends on the Bleve search engine being enabled and on an attacker-exploitable sibling-directory naming condition. Net assessment: a real, confirmed authorization-bypass/information-disclosure bug worth patching, but not an emergency - the combination of required authentication, limited impact, and non-default feature dependency keeps real-world risk low despite the network attack vector.

A low-privileged OpenList user whose BasePath is restricted to /base authenticates and sends a search request against the global index. Because the sibling directory /base2 passes the non-separator-aware strings.HasPrefix(node.Parent, user.BasePath) check, the user retrieves metadata for files such as /base2/secret_financial_report.pdf outside their namespace, or infers the existence of hidden files via the unfiltered Total count. A complete step-by-step PoC is published in the GHSA advisory, so working exploit code is publicly available.