Read the docs
TI-2026-85238 Aliases CVE-2026-54378GHSA-jr4h-546g-564w

Broken access control in VitaFit cloud API exposes other users' files

Priority MEDIUM 40CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-522.

Summary

The VitaFit cloud API before 2026-10-30 has a broken access control flaw that lets any authenticated user obtain temporary AWS credentials (CWE-522). Attackers can use these improperly scoped credentials to list a shared storage bucket and read or overwrite other users' stored files. An exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.

Why it matters now

EPSS 0.00231 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed VitaFit (Shenzhen Shine Industrial Co., Ltd.): 2026-10-30

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Shenzhen Shine Industrial Co., Ltd.VitaFitbefore 2026-10-302026-10-30Patch availableCNA

Remediation

Update VitaFit to 2026-10-30, the listed fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA VitaFit (Shenzhen Shine Industrial Co., Ltd.) Fixed in 2026-10-30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Shenzhen Shine Industrial VitaFit 2026-10-30

    7 records Highest priority Priority MEDIUM 2 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-85254 Authentication bypass in VitaFit Cloud API login endpointPriority MEDIUM 41
    • TI-2026-85244 Misconfigured storage bucket in VitaFit Cloud API exposes user filesPriority LOW 38
    • TI-2026-85253 Excessive data exposure in VitaFit cloud API relation search endpointPriority LOW 31
    Show all 7 records →

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-54378
  2. 2026-11-05 Alias added: GHSA-jr4h-546g-564w

References

Exploit 1

Other 1

  • TI-2026-85254 Authentication bypass in VitaFit Cloud API login endpoint CVSS 4.0CRITICAL 9.3
  • TI-2026-85244 Misconfigured storage bucket in VitaFit Cloud API exposes user files CVSS 4.0HIGH 8.7
  • TI-2026-85234 Hardcoded credentials in VitaFit Android expose third-party secrets CVSS 4.0HIGH 8.7
  • TI-2026-85232 Insecure TLS certificate validation in VitaFit Android app CVSS 4.0HIGH 8.7
  • TI-2026-85235 VitaFit Android Long-Lived Session Token Exposure CVSS 4.0HIGH 8.6
  • TI-2026-85236 Custom URI scheme flaw in VitaFit Android lets apps steal Fitbit tokens CVSS 4.0HIGH 8.2
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences