{"id":"CVE-2026-54378","title":"VitaFit Cloud API Broken Access Control via S3 Token Endpoint","summary":"VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improp…","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-522"],"vendor":"Shenzhen Shine Industrial Co., Ltd.","product":"VitaFit","affected":["VitaFit < 2026-10-30"],"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T22:09:16.025Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54378","references":[{"url":"https://github.com/je-lv/vitafit-security-research","label":"Researcher Disclosure"},{"url":"https://play.google.com/store/apps/details?id=com.vt.vitafit","label":"Google Play"},{"url":"https://www.vulncheck.com/advisories/vitafit-cloud-api-broken-access-control-via-s3-token-endpoint","label":"VulnCheck Advisory: VitaFit Cloud API Broken Access Control via S3 Token Endpoint"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.637Z","slug":"CVE-2026-54378","body":"## Overview\n\nVitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.\n\n## Affected\n\n- `VitaFit < 2026-10-30`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}