Read the docs
TI-2026-85237 Aliases CVE-2026-54377GHSA-h9gp-qv79-4jmg

Insecure direct object reference in VitaFit cloud API exposes user data

Priority LOW 30CWE-639Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

VitaFit cloud API before 2026-10-30 from Shenzhen Shine Industrial Co., Ltd. contains an authorization bypass through a user-controlled key (CWE-639). An authenticated attacker can supply a different user_id or profile_id to endpoints such as GET /front/profile/{profile_id}/report/ and read another user's data, and predictable identifiers plus an account-enumeration weakness let attackers read other accounts' email addresses, profiles, body-composition reports and measurement history at scale. An exploit link is listed in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different user_id or profile_id to endpoints such as GET /front/profile/{profile_id}/report/ and GET /front/profile/{profile_id}/body_index_per_day/. Attackers can leverage predictable user_id and profile_id relationships combined with an account-enumeration weakness to read another account's email address, profile, body-composition report, and measurement history at scale.

Why it matters now

EPSS 0.00183 7th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed VitaFit (Shenzhen Shine Industrial Co., Ltd.): 2026-10-30

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Shenzhen Shine Industrial Co., Ltd.VitaFitbefore 2026-10-302026-10-30Patch availableCNA

Remediation

Update VitaFit to 2026-10-30, the fixed version listed by the vendor. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA VitaFit (Shenzhen Shine Industrial Co., Ltd.) Fixed in 2026-10-30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Shenzhen Shine Industrial VitaFit 2026-10-30

    7 records Highest priority Priority MEDIUM 2 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-85254 Authentication bypass in VitaFit Cloud API login endpointPriority MEDIUM 41
    • TI-2026-85238 Broken access control in VitaFit cloud API exposes other users' filesPriority MEDIUM 40
    • TI-2026-85244 Misconfigured storage bucket in VitaFit Cloud API exposes user filesPriority LOW 38
    Show all 7 records →

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-54377
  2. 2026-11-05 Alias added: GHSA-h9gp-qv79-4jmg
  3. 2026-11-06 Priority changed: MEDIUM → LOW

References

Exploit 1

Other 1

  • TI-2026-85254 Authentication bypass in VitaFit Cloud API login endpoint CVSS 4.0CRITICAL 9.3
  • TI-2026-85238 Broken access control in VitaFit cloud API exposes other users' files CVSS 4.0CRITICAL 9.3
  • TI-2026-85244 Misconfigured storage bucket in VitaFit Cloud API exposes user files CVSS 4.0HIGH 8.7
  • TI-2026-85234 Hardcoded credentials in VitaFit Android expose third-party secrets CVSS 4.0HIGH 8.7
  • TI-2026-85232 Insecure TLS certificate validation in VitaFit Android app CVSS 4.0HIGH 8.7
  • TI-2026-85235 VitaFit Android Long-Lived Session Token Exposure CVSS 4.0HIGH 8.6
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences