CVE-2026-111701: OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.
Affected Software
Event History
Frequently Asked Questions
What must an attacker know to access or delete private objects?
The attacker needs the tenant subdomain, bucket ID, and object path. No API key or JWT is required once those values are known.
Which storage operations are exposed?
Unauthenticated attackers can download objects from private buckets and delete stored objects. The affected object endpoint is treated as public for every HTTP method.
Are deployments affected by default?
The described behavior treats /storage/v1/object/{bucketId}/{path} as public regardless of HTTP method, so private bucket objects reachable through that endpoint are exposed without requiring an API key or JWT.
How can I determine whether objects may already be exposed?
Review whether a deployment uses a tenant subdomain and private bucket objects served through /storage/v1/object/{bucketId}/{path}. Objects whose bucket IDs and paths could be known or discovered may have been downloadable or deletable without authentication.