{"id":"CVE-2026-111701","kind":"vulnerability","aliases":["CVE-2026-111701"],"related":[],"title":"OtterMind Nubase: unauthenticated access to private storage bucket objects","description":"OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.","summary":"OtterMind Nubase 0.1.4 and earlier (reporter says current main too) serves GET and DELETE on /storage/v1/object/{bucketId}/{path} with no apikey or JWT. Tenant resolves from the subdomain and the bucket's private flag is never checked. Anyone who knows tenant subdomain, bucket id and object path can read or delete private objects. No fixed release found.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Nubase","fixed":[],"affected":"<= 0.1.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["missing-authentication","multi-tenant","nubase","other","self-hosted","storage","supabase-compatible-storage"],"not_affected_if":["no-private-bucket-data","not-internet-reachable","not-using-storage","unknown"],"how_to_check":"Run a self-hosted Nubase <= 0.1.4 (docker image ottermind/nubase:0.1.4 or earlier)? Then you are exposed. Test: from outside, request GET https://<tenant-subdomain>/storage/v1/object/<private-bucket>/<known-object> with no apikey or Authorization header. A 200 with file content means exposed. Check access logs for unauthenticated GET/DELETE on /storage/v1/object/ paths that are not public/, authenticated/, sign/, upload/, info/, list/, move or copy.","fix":"No fixed release as of 2026-10-25: v0.1.4 is the latest tag and the reporter says main is also affected. Until a fix ships: block or require auth at your reverse proxy/WAF for /storage/v1/object/* except /public/ and /authenticated/ paths (at least DELETE), keep Nubase off the public internet where possible, and use the /object/authenticated/ route. Watch github.com/OtterMind/Nubase for a release after 0.1.4.","status":"open","published_at":"2026-10-16T18:17:53+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:02:30+00:00","updated_at":"2026-10-25T03:44:49+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-25T03:02:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OtterMind Nubase: unauthenticated access to private storage bucket objects","impact":"high","summary":"OtterMind Nubase through 0.1.4 treats its storage object endpoint as public for every HTTP method. An attacker who knows a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an API key or JWT.","category":"other","nicknames":[],"who_cares":["nubase","self-hosted","supabase-compatible-storage"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker downloads or deletes private bucket objects without credentials","analyst_note":"Check the NVD entry and the OtterMind Nubase project for a fixed release and for the exact default configuration of the storage endpoint.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running OtterMind Nubase 0.1.4 or earlier that store private files in Nubase storage buckets. The sources do not say whether managed hosting is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000546,"input_tokens":3354,"output_tokens":421,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the OtterMind Nubase project for a fixed release and for the exact default configuration of the storage endpoint.","search":"'-111701':12A,15A '-2026':11A,14A '/storage/v1/object':48B,109C '0.1.4':35B,93C 'access':4A,104C 'allow':100C 'anyon':70B 'apikey':53B,142C 'attack':102C,120C 'authent':19B,97C 'bucket':8A,63B,75B,106C,125C,135C 'bucketid':49B,110C 'check':69B 'compat':31B 'contain':94C 'current':40B 'cve':10A,13A 'delet':46B,83B,137C 'download':131C 'earlier':37B 'everi':117C 'fix':87B 'flag':66B 'found':89B 'get':44B 'host':27B 'http':118C 'id':76B,126C 'jwt':55B,144C 'know':72B,121C 'main':41B 'method':119C 'miss':18B,96C 'missing-authent':17B 'multi':21B 'multi-ten':20B 'never':68B 'nubas':2A,23B,34B,91C 'nubase':16A 'object':9A,78B,85B,107C,128C,132C,139C 'ottermind':1A,33B,90C 'path':50B,79B,111C,129C 'privat':6A,65B,84B,105C,134C 'public':115C 'read':81B 'releas':88B 'report':38B 'resolv':57B 'say':39B 'self':26B 'self-host':25B 'serv':43B 'storag':7A,28B,32B 'store':138C 'subdomain':60B,74B,124C 'supabas':30B 'supabase-compatible-storag':29B 'tenant':22B,56B,73B,123C 'treat':113C 'unauthent':3A,101C 'vulner':98C 'without':140C","nicknames":[],"mitigations":[],"who_affected":"Teams running OtterMind Nubase 0.1.4 or earlier that store private files in Nubase storage buckets. The sources do not say whether managed hosting is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111701","severity":null,"published_at":"2026-10-16T18:17:53+00:00","modified_at":"2026-10-16T22:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111701:783","url":null,"severity":null,"published_at":"2026-10-25T03:44:49+00:00","modified_at":"2026-10-25T03:44:49+00:00","first_seen_at":"2026-10-25T03:44:49+00:00","fetched_at":"2026-10-25T03:44:49+00:00","note":"Read VulnCheck advisory, NVD, reporter write-up (hackmd, source-review only, not executed) and GitHub releases. No fixed release exists: v0.1.4 is latest, reporter says main at dce7177 is also affected; SECURITY.md says fixes land on main only. Nothing marked verified (no vendor advisory). No public exploitation seen."}],"documents":[{"id":3318,"url":"https://www.vulncheck.com/advisories/ottermind-nubase-through-0.1.4-missing-authentication-in-storage-object-api","title":"VulnCheck: OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3319,"url":"https://hackmd.io/@hieuPenguinnn/nubase-storage-private-object-unauth-download","title":"Nubase storage default download route serves private-bucket objects without authentication (reporter write-up)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3320,"url":"https://github.com/OtterMind/Nubase/releases","title":"OtterMind/Nubase releases (latest v0.1.4)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}