{"id":"CVE-2026-54378","published":"2026-11-04T22:18:05.777","lastModified":"2026-11-04T22:18:05.777","description":"VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-522"],"vendors":[],"products":[],"references":[{"url":"https://github.com/je-lv/vitafit-security-research","tags":[]},{"url":"https://play.google.com/store/apps/details?id=com.vt.vitafit","tags":[]},{"url":"https://www.vulncheck.com/advisories/vitafit-cloud-api-broken-access-control-via-s3-token-endpoint","tags":[]}],"exploitRefs":[{"url":"https://github.com/je-lv/vitafit-security-research","tags":[]}],"hasPoc":true,"ai":{"summary":"The VitaFit cloud API before 2026-10-30 exposed an endpoint that returned temporary AWS credentials with overly broad permissions to any authenticated user, bypassing intended access controls and enabling unauthorized access to other users' data in shared storage.","exploitability":"Exploitation requires only a valid authenticated session and knowledge of the vulnerable endpoint; no special tools or privileges beyond standard API access are needed.","blast_radius":"Any authenticated attacker can read or overwrite any user's files in the shared storage bucket, leading to full cross-user data exposure and potential data integrity compromise.","remediation":"Upgrade to VitaFit cloud API version 2026-10-30 or later, which fixes the access control flaw by properly scoping AWS credentials per user.","detection":"Defenders should monitor for repeated calls to POST /front/user/s3/token/ from a single authenticated session, especially when followed by S3 ListBucket or GetObject requests to objects outside the caller's expected namespace; anomalous credential usage patterns in AWS CloudTrail logs may also indicate exploitation.","tags":["access-control-bypass","aws-credentials-leak","data-exfiltration","broken-auth","cloud-api"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:47:38.008Z"}}