CVE-2026-111701
CVE-2026-111701 · OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.
CVSS 8.3 · Alta · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
nubase
- Versiones
- ≥ 0, ≤ 0.1.4: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@hieuPenguinnn/nubase-storage-private-object-unauth-download
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/common/multitenancy/UnifiedMultiTenancyFilter.java#L363-L379
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/auth/controller/storage/StorageObjectReadController.java#L68-L74
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/auth/service/StorageService.java#L176-L200
- https://www.vulncheck.com/advisories/ottermind-nubase-through-0.1.4-missing-authentication-in-storage-object-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-111701