{"uuid": "418639b7-3194-4734-b98b-a4ce12d17028", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-P6PH-3JX2-3337", "type": "seen", "source": "https://gist.github.com/alon710/7ac48e75205a16d278d7edd78b6790dd", "content": "# GHSA-P6PH-3JX2-3337: GHSA-P6PH-3JX2-3337: Horizontal Privilege Escalation and Metadata Information Disclosure via Bleve Search in OpenList\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-P6PH-3JX2-3337\n\n## Summary\nOpenList version 4.2.3 and prior is vulnerable to an authorization bypass and metadata leakage. When configured with the Bleve search engine backend, OpenList fails to perform separator-aware path matching when validating tenant containment. This allows authenticated users to access sibling directories sharing similar name prefixes. Furthermore, the search backend returns unfiltered global result counts, leaking existence verification data of unauthorized files via side-channel analysis.\n\n## TL;DR\nA flaw in the directory verification logic using strings.HasPrefix allows low-privileged users to search and view metadata of sibling directories. Additionally, Bleve search queries leak global hit statistics, allowing blind metadata verification across restricted scopes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639, CWE-200\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.3 (Medium)\n- **Exploit Status**: poc\n- **CISA KEV Status**: No\n- **Fixed Version**: 4.2.4\n- **Ecosystem**: Go\n\n## Affected Systems\n\n- OpenList instances with search indexing configured to Bleve\n- **OpenList**: <= 4.2.3 (Fixed in: `4.2.4`)\n\n## Mitigation\n\n- Upgrade OpenList server to version 4.2.4 or newer.\n- Disable the Bleve search engine backend in application configurations if patches cannot be applied immediately.\n- Avoid utilizing overlapping or similar prefix names for tenant directories on the system storage root.\n\n**Remediation Steps:**\n1. Stop the running OpenList server process.\n2. Download the v4.2.4 release binary from the official repository releases page.\n3. Verify system configurations and restart the service.\n4. Optionally re-index search parameters to ensure Bleve runs with updated parameters.\n\n## References\n\n- [OpenList Advisory Details (GHSA-P6PH-3JX2-3337)](https://github.com/advisories/GHSA-P6PH-3JX2-3337)\n- [OpenList Source Code Repository](https://github.com/OpenListTeam/OpenList)\n- [Remediation Patch Commit: Directory Boundaries](https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a)\n- [Remediation Patch Commit: Search Filter Count Leak](https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-P6PH-3JX2-3337) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T16:31:29.360562Z"}