CVE-2026-111701
7.0HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-306
Impact
Unauthenticated attackers with network access can download or delete private bucket objects without credentials. They only need to know or guess the tenant subdomain, bucket ID, and object path.
Root cause
The API endpoint /storage/v1/object/{bucketId}/{path} is incorrectly configured as public across all HTTP methods, bypassing authentication checks.
Affected systems
OtterMind Nubase through 0.1.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Fix & remediation
Upgrade to a version newer than 0.1.4 once published by the vendor. If an immediate patch is unavailable, block external access to the /storage/v1/object/ route at your reverse proxy or API gateway.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.
References
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/auth/controller/storage/StorageObjectReadController.java#L68-L74
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/auth/service/StorageService.java#L176-L200
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/common/multitenancy/UnifiedMultiTenancyFilter.java#L363-L379
- https://hackmd.io/@hieuPenguinnn/nubase-storage-private-object-unauth-download
- https://www.vulncheck.com/advisories/ottermind-nubase-through-0.1.4-missing-authentication-in-storage-object-api