CVE-2026-111701: Missing Authentication for Critical Function in OtterMind Nubase
Description
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.
CVSS v4.0
Score 8.3high
Affected software
OtterMind
Nubase
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111701 describes a missing authentication vulnerability in OtterMind Nubase through version 0.1.4. The vulnerability arises because the /storage/v1/object/{bucketId}/{path} endpoint does not enforce authentication for any HTTP method, effectively making private bucket objects publicly accessible. Attackers with knowledge of a tenant subdomain, bucket ID, and object path can exploit this flaw to download or delete objects without any credentials such as an API key or JWT token. The CVSS 4.0 base score is 8.3, indicating a high severity vulnerability with network attack vector, high impact on confidentiality, and low impact on integrity and availability.
Potential Impact
Unauthenticated attackers can access and delete private bucket objects in OtterMind Nubase, leading to unauthorized data disclosure and potential data loss. This compromises confidentiality and availability of stored objects in affected versions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict knowledge of tenant subdomains, bucket IDs, and object paths to trusted parties only, and monitor for unauthorized access attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-16T14:31:21.858Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad264192cdf04f656199d2a
Added to database: 10/16/2026, 17:51:21 UTC
Last enriched: 10/16/2026, 18:04:27 UTC
Last updated: 10/16/2026, 21:50:42 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.