CVE-2026-111701 OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API

OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/bucketId/path is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object pat...

CVE-2026-111701

OtterMind Nubase through version 0.1.4 is vulnerable to a missing authentication flaw in the Storage Object API. The vulnerability exists because the endpoint /storage/v1/object/{bucketId}/{path} is incorrectly treated as public for all HTTP methods. Consequently, an unauthenticated attacker who ...