OtterMind Nubase CVE-2026-111701

Exploitation requires that the attacker know three concrete values: a valid Nubase tenant subdomain, a bucket id, and an object path, which are then requested at /storage/v1/object/{bucketId}/{path}. The root cause is that the UnifiedMultiTenancyFilter classifies this storage-object route as public for every HTTP method, so no apikey and no JWT are needed. Limiting factors: the attacker must obtain or brute-force the non-default bucket id and object path (reflected as AC:H/AT:P), which prevents indiscriminate mass exploitation; only deployments running Nubase at or below version 0.1.4 are affected.

Signals conflict in an informative way. The vendor CVSS 4.0 base score of 8.3 (AV:N/PR:N/UI:N) reflects an internet-reachable, unauthenticated storage endpoint - attractive on paper - but the same vector carries AC:H and AT:P, meaning successful exploitation depends on the attacker already knowing a valid tenant subdomain, bucket id, and object path, which are not trivially guessable and must be enumerated or leaked. No EPSS score was provided in the input, so exploitation-probability cannot be weighed. The CVE is not listed in CISA KEV, so there is no evidence of active exploitation. No standalone exploit code is referenced, though a detailed public write-up (hackmd) and the exact vulnerable source lines in UnifiedMultiTenancyFilter, StorageObjectReadController, and StorageService are published, which materially lowers the bar to building a working exploit. No SSVC decision data was supplied. Net assessment: this is a genuine design-level auth bypass with high confidentiality impact plus object-deletion (integrity/availability) impact, but real-world priority is tempered by the AC:H/AT:P knowledge requirement and by the product's apparent tiny deployment footprint (a 0.1.x-era niche backend). Treat as a real fix-it-now issue for the small population actually running Nubase, not a broad emergency.

An attacker who has identified a target organization's Nubase tenant subdomain and learned (or enumerated) a bucket id and object path sends a plain HTTP request to /storage/v1/object/{bucketId}/{path} with no apikey or JWT. Because the multi-tenancy filter treats that route as public for every HTTP method, the attacker downloads private objects (GET) and can destroy stored objects (DELETE). A public technical write-up documents the flaw and the vulnerable code, so a working request is straightforward to craft, though no packaged exploit tool is referenced.