Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-54378: VitaFit Cloud API lets signed‑in users access others’ files
CVE-2026-54378 · published today
Summary
In the VitaFit cloud service, any user who has logged in can request a special token that gives them temporary cloud storage credentials. With those credentials they can view, change, or delete files that belong to other users. Upgrade to the version released after October 30, 2026 or apply the vendor’s fix and review access controls for the storage bucket.
What to do
- Update shenzhen shine industrial co., ltd. vitafit to version 2026-10-30 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| shenzhen shine industrial co., ltd. | vitafit | < 2026-10-30 |
Original advisory text
VitaFit Cloud API Broken Access Control via S3 Token Endpoint
VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.
References
- https://github.com/je-lv/vitafit-security-research technical-description exploit
- https://play.google.com/store/apps/details?id=com.vt.vitafit product
- https://www.vulncheck.com/advisories/vitafit-cloud-api-broken-access-control-via... third-party-advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-522Insufficiently Protected Credentials
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Track software like this
Free during beta