CVE-2026-111701 — OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/…
Published: 2026-10-16 · CVSS: 8.3 · CVSS 4.0
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7