CVE-2026-111701 Details

A missing authentication vulnerability has been identified in OtterMind Nubase versions through 0.1.4. This vulnerability allows unauthenticated attackers to access private bucket objects via the default download route, '/storage/v1/object/{bucketId}/{path}', which is improperly treated as public for all HTTP methods. Attackers who know a tenant subdomain, bucket ID, and object path can download objects from private buckets and delete stored objects, all without the need for an API key or JWT.

To address this vulnerability, it is recommended to enforce authentication checks on the default object download route and to consult the bucket's privacy settings before allowing access to its contents. For the deletion route, similar authentication requirements should be implemented.