Read the docs
TI-2026-85244 Aliases CVE-2026-54381GHSA-qg7r-2qmf-p77f

Misconfigured storage bucket in VitaFit Cloud API exposes user files

Priority LOW 38CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Shenzhen Shine Industrial Co., Ltd. VitaFit cloud API versions from 0 before 2026-10-30 contain a misconfigured cloud storage bucket that is publicly accessible. An unauthenticated remote attacker can list and download stored files, including user-uploaded profile images, without credentials. The weakness is classified as CWE-732, Incorrect Permission Assignment for Critical Resource, and a public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881 user-uploaded profile images, to access sensitive personal data without credentials.

Why it matters now

EPSS 0.00422 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed VitaFit (Shenzhen Shine Industrial Co., Ltd.): 2026-10-30

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Shenzhen Shine Industrial Co., Ltd.VitaFitbefore 2026-10-302026-10-30Patch availableCNA

Remediation

VitaFit is fixed in version 2026-10-30 and later. CISA has not added this vulnerability to its Known Exploited Vulnerabilities catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA VitaFit (Shenzhen Shine Industrial Co., Ltd.) Fixed in 2026-10-30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Shenzhen Shine Industrial VitaFit 2026-10-30

    7 records Highest priority Priority MEDIUM 2 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-85254 Authentication bypass in VitaFit Cloud API login endpointPriority MEDIUM 41
    • TI-2026-85238 Broken access control in VitaFit cloud API exposes other users' filesPriority MEDIUM 40
    • TI-2026-85253 Excessive data exposure in VitaFit cloud API relation search endpointPriority LOW 31
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-54381
  2. 2026-11-05 Alias added: GHSA-qg7r-2qmf-p77f
  3. 2026-11-06 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Exploit 1

Other 1

  • TI-2026-85254 Authentication bypass in VitaFit Cloud API login endpoint CVSS 4.0CRITICAL 9.3
  • TI-2026-85238 Broken access control in VitaFit cloud API exposes other users' files CVSS 4.0CRITICAL 9.3
  • TI-2026-85234 Hardcoded credentials in VitaFit Android expose third-party secrets CVSS 4.0HIGH 8.7
  • TI-2026-85232 Insecure TLS certificate validation in VitaFit Android app CVSS 4.0HIGH 8.7
  • TI-2026-85235 VitaFit Android Long-Lived Session Token Exposure CVSS 4.0HIGH 8.6
  • TI-2026-85236 Custom URI scheme flaw in VitaFit Android lets apps steal Fitbit tokens CVSS 4.0HIGH 8.2
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences