CVE-2026-111701
Received Received - Intake

OtterMind Nubase Missing Authentication in Storage API

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111701
EUVD
EUVD-2026-102992

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OtterMind Nubase 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OtterMind Nubase through 0.1.4 has a missing authentication vulnerability where private bucket objects can be accessed without authentication. The endpoint /storage/v1/object/{bucketId}/{path} is incorrectly treated as public for all HTTP methods, allowing attackers with knowledge of a tenant subdomain, bucket ID, and object path to download or delete private objects without an API key or JWT.

Detection Guidance

Check for unauthorized access to /storage/v1/object/{bucketId}/{path} endpoints. Monitor HTTP requests to these paths for missing authentication headers or unexpected access patterns. Review logs for requests with tenant subdomains, bucket IDs, and object paths that bypass authentication.

Impact Analysis

Unauthenticated attackers could access sensitive data stored in private buckets, leading to data breaches. They could also delete critical files, disrupting operations or causing data loss. This affects confidentiality and integrity of stored information.

Compliance Impact

This vulnerability likely violates GDPR (data protection) and HIPAA (health data security) by exposing or allowing deletion of sensitive personal or health information without authorization. Non-compliance could result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Restrict access to /storage/v1/object/{bucketId}/{path} endpoints by implementing proper authentication. Ensure all requests require valid apikeys or JWT tokens. Update OtterMind Nubase to a patched version if available. Audit and remove any public access settings for private buckets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111701. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart