CVE-2026-111701

OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API

8.3 High

OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: Low

Exploit likelihood

0.30%Unchanged since Oct 17, 2026

What each source reports

CVE List Score used 8.3

OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API

Record: CVE-2026-111701
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Weakness: CWE-306
Updated: 2026-11-02

EUVDEUVD-2026-102992 8.3

Record: EUVD-2026-102992
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4jxc-c3cr-q9xx 8.3

OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows...

Record: GHSA-4jxc-c3cr-q9xx
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Weakness: CWE-306
Updated: 2026-11-02

NVD 8.3

Record: CVE-2026-111701
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Weakness: CWE-306
Updated: 2026-11-02

OSV 8.3

OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API

Record: CVE-2026-111701
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness: CWE-306
Updated: 2026-11-02

Affected products

ottermind nubase

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-111701 is a high vulnerability (CVSS 8.3) in Ottermind Nubase, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. No source names a fixed version.