GHSA-P6PH-3JX2-3337: Horizontal Privilege Escalation and Metadata Information Disclosure via Bleve Search in OpenList

Vulnerability ID: GHSA-P6PH-3JX2-3337
CVSS Score: 4.3
Published: 2026-07-24

OpenList version 4.2.3 and prior is vulnerable to an authorization bypass and metadata leakage. When configured with the Bleve search engine backend, OpenList fails to perform separator-aware path matching when validating tenant containment. This allows authenticated users to access sibling directories sharing similar name prefixes. Furthermore, the search backend returns unfiltered global result counts, leaking existence verification data of unauthorized files via side-channel analysis.

TL;DR

A flaw in the directory verification logic using strings.HasPrefix allows low-privileged users to search and view metadata of sibling directories. Additionally, Bleve search queries leak global hit statistics, allowing blind metadata verification across restricted scopes.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-639, CWE-200
• Attack Vector: Network
• CVSS v3.1 Score: 4.3 (Medium)
• Exploit Status: poc
• CISA KEV Status: No
• Fixed Version: 4.2.4
• Ecosystem: Go

Affected Systems

• OpenList instances with search indexing configured to Bleve
• OpenList: <= 4.2.3 (Fixed in: 4.2.4)

Code Analysis

Commit: 59bd343

Fix path boundary bypass validation by replacing HasPrefix with IsSubPath and applying retroactive base path audits.

Commit: 84ecda3

Implement pre-pagination result checks in Bleve client to resolve search statistics side-channel leak.

Exploit Details

• GitHub Security Advisory: Vulnerability overview with reproduction configuration setup instructions.

Mitigation Strategies

• Upgrade OpenList server to version 4.2.4 or newer.
• Disable the Bleve search engine backend in application configurations if patches cannot be applied immediately.
• Avoid utilizing overlapping or similar prefix names for tenant directories on the system storage root.

Remediation Steps:

1. Stop the running OpenList server process.
2. Download the v4.2.4 release binary from the official repository releases page.
3. Verify system configurations and restart the service.
4. Optionally re-index search parameters to ensure Bleve runs with updated parameters.

References

• OpenList Advisory Details (GHSA-P6PH-3JX2-3337)
• OpenList Source Code Repository
• Remediation Patch Commit: Directory Boundaries
• Remediation Patch Commit: Search Filter Count Leak

Read the full report for GHSA-P6PH-3JX2-3337 on our website for more details including interactive diagrams and full exploit analysis.