Nubase
Monthly
Missing authentication in the OtterMind Nubase storage-object API (versions through 0.1.4) lets remote attackers download and delete objects held in private buckets without supplying an apikey or JWT. The UnifiedMultiTenancyFilter treats the route /storage/v1/object/{bucketId}/{path} as public for every HTTP method, so any request reaching that endpoint bypasses tenant authorization entirely; per the independent assessment the impact is a high-confidentiality, low-integrity/availability compromise (CVSS:3.1 8.3-equiv, AV:N/AC:H/PR:N/UI:N/C:H/I:L/A:L), gated only by the attacker's prior knowledge of a valid tenant subdomain, bucket id and object path. No public exploit code or CISA KEV entry was identified at time of analysis, and no vendor-released patch is confirmed.
Missing authentication in the OtterMind Nubase storage-object API (versions through 0.1.4) lets remote attackers download and delete objects held in private buckets without supplying an apikey or JWT. The UnifiedMultiTenancyFilter treats the route /storage/v1/object/{bucketId}/{path} as public for every HTTP method, so any request reaching that endpoint bypasses tenant authorization entirely; per the independent assessment the impact is a high-confidentiality, low-integrity/availability compromise (CVSS:3.1 8.3-equiv, AV:N/AC:H/PR:N/UI:N/C:H/I:L/A:L), gated only by the attacker's prior knowledge of a valid tenant subdomain, bucket id and object path. No public exploit code or CISA KEV entry was identified at time of analysis, and no vendor-released patch is confirmed.