VITAFIT CLOUD API · CVE-2026-54378 · Vendor
NO FIX YET · SEE WHAT TO DO
The VitaFit cloud API before 2026-10-30 lets any authenticated user call POST /front/user/s3/token/ and receive temporary AWS credentials. Those credentials are over-scoped, so an attacker can list the shared storage bucket and read or overwrite other users' stored files.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone with a VitaFit account is in reach, because the flaw needs only an authenticated user, not special configuration. Whether a given deployment is still exposed depends on the vendor's fix, which the sources do not describe. Teams that do not use the VitaFit cloud API are not affected.
Not affected if not-a-vitafit-user
Who cares aws-s3, cloud-api, cognito, saas, vitafit
2.8.1.0 or later (fixes sibling CVEs, not confirmed for this one)2.8.1.0VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.