CVE-2026-111701
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows…
- Risk score
- 52/100
- CVSS
- 7.0 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 16 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download obj…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.0 high
- Remotely exploitable without logging in
References
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/auth/controller/storage/StorageObjectReadController.java#L68-L74
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/auth/service/StorageService.java#L176-L200
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/common/multitenancy/UnifiedMultiTenancyFilter.java#L363-L379
- https://hackmd.io/@hieuPenguinnn/nubase-storage-private-object-unauth-download
- https://www.vulncheck.com/advisories/ottermind-nubase-through-0.1.4-missing-authentication-in-storage-object-api
Original description
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.
Last activity 16 Oct 2026. Patch Forecast updates every hour.