Authentication Bypass Vulnerability in OtterMind Nubase

OtterMind Nubase through version 0.1.4 contains a critical missing authentication vulnerability affecting the storage API endpoint at /storage/v1/object/{bucketId}/{path}. This flaw stems from a misconfiguration where the API treats all HTTP methods as public, failing to enforce authorization checks for requests directed at private buckets. An attacker who has discovered the target's tenant subdomain, bucket ID, and specific object path can interact with private storage resources without providing an API key or a JSON Web Token (JWT). This access allows unauthenticated parties to download sensitive objects or perform unauthorized deletion operations, potentially resulting in significant data exfiltration or service disruption. Organizations running Nubase 0.1.4 or earlier are susceptible to this risk and should ensure access controls are appropriately restricted or apply available patches.

Impact

Successful exploitation of this vulnerability permits unauthenticated users to gain unauthorized access to private bucket objects. Impact includes potential exposure of confidential data through forced downloads and the destruction of business-critical information via unauthorized deletion commands. There is currently no evidence of widespread exploitation in the wild, but the simplicity of the attack path increases the risk for organizations utilizing Nubase in public-facing or multi-tenant environments.

Recommendation

• Audit web server and application gateway access logs for unauthorized GET or DELETE requests targeting the /storage/v1/object/ API path from unexpected source IPs.
• Patch all instances of OtterMind Nubase to a version newer than 0.1.4 immediately to remediate the broken authentication logic.
• Restrict external network access to the storage API endpoints using IP allowlisting or WAF rules until patching is completed.