OtterMind Nubase up to version 0.1.4 contains a missing authentication flaw that causes the /storage/v1/object/{bucketId}/{path} endpoint to be treated as public for all HTTP methods. Because authentication is not enforced, an attacker who knows a tenant subdomain, bucket identifier and object path can download any private object and also delete objects from the bucket. This flaw gives the attacker full read and delete privilege over stored data, compromising confidentiality, integrity and availability of the application data.

The affected product is OtterMind Nubase, version 0.1.4. No other versions were identified as vulnerable in the CVE data. The flaw is present in the storage object controller and storage service layers referenced in the code locations in the CVE report.

The CVSS score for this vulnerability is 8.3, indicating a high severity. The EPSS score is not available, but the absence of a KEV listing suggests the flaw is not currently known as a widely exploited vulnerability. Attackers need only the bucket id and object path, which can be discovered through enumeration or public disclosure, and can exploit the flaw trivially without any authentication. The risk of accidental or malicious data loss and leakage is therefore significant.