Threats tagged 'ghsa-4jxc-c3cr-q9xx'

OtterMind Nubase versions up to 0.1.4 have a missing authentication vulnerability that allows unauthenticated attackers to access and delete private bucket objects. The endpoint /storage/v1/object/{bucketId}/{path} is treated as public for all HTTP methods, enabling attackers who know a tenant subdomain, bucket ID, and object path to download or delete objects without requiring an API key or JWT.