Is CVE-2026-111701 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111701?

CVE-2026-111701 has a CVSS v3 severity of HIGH (7).

Back

CVE-2026-111701

Description

OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.