OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.3NVD modified 2026-10-16 22:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/auth/controller/storage/StorageObjectReadController.java#L68-L74
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/auth/service/StorageService.java#L176-L200
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/common/multitenancy/UnifiedMultiTenancyFilter.java#L363-L379
- https://hackmd.io/@hieuPenguinnn/nubase-storage-private-object-unauth-download
- https://www.vulncheck.com/advisories/ottermind-nubase-through-0.1.4-missing-authentication-in-storage-object-api