CVE-2026-102663 OpenList Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search. The vulnerability allows unauthorized disclosure of file metadata or file-existence information in OpenList deployments prior to version 4.2.4. This issue arises from the search API's use of a non-separator-aware strings.HasPrefix comparison as a path containment authorization check. Affected depl [truncated]
An authenticated user with CanShare permission in OpenList versions prior to 4.2.4 can create a share for a file outside their assigned directory, allowing them to read data outside the directory. This issue is fixed in version 4.2.4. The vulnerability allows unauthorized data access. Defenders should assess exposure and prioritize upgrading to version 4.2.4 or later to prevent unauthorized data access. T [truncated]
A vulnerability in OpenList's file list program allows an authenticated user with rename permission to manipulate file paths, potentially leading to cross-user file integrity loss, limited availability impact, and file-existence disclosure. The issue is fixed in version 4.2.4. This vulnerability arises from inadequate validation of user-supplied input in the /api/fs/batch_rename handler, which could allow [truncated]
