{"id":"CVE-2026-54378","kind":"vulnerability","aliases":["CVE-2026-54378"],"related":[],"title":"VitaFit cloud API: any logged-in user reads and overwrites other users' files","description":"VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.","summary":"The VitaFit cloud API before 2026-10-30 lets any authenticated user call POST /front/user/s3/token/ and receive temporary AWS credentials. Those credentials are over-scoped, so an attacker can list the shared storage bucket and read or overwrite other users' stored files.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VitaFit cloud API","fixed":[],"affected":"< 2026-10-30","ecosystem":"vendor"}],"ecosystems":[],"tags":["aws-s3","cloud-api","cognito","saas","vendor","vitafit"],"not_affected_if":["not-a-vitafit-user"],"how_to_check":"Nothing to check on your side: this is in the vendor's cloud API, not software you run. VulnCheck's page gives no test for whether the fix is live. Also check if you use the VitaFit Android app and update it to 2.8.1.0 or later (fixes sibling CVEs, not confirmed for this one).","fix":"Server-side change by the vendor; VulnCheck lists the API as affected before 2026-10-30. Vendor confirmation not found. No customer action known except app updates; Android app fixes for sibling CVEs are in 2.8.1.0.","status":"open","published_at":"2026-11-04T22:18:05+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","triaged_at":"2026-11-04T23:09:39+00:00","updated_at":"2026-11-04T23:10:31+00:00","category":"vendor","confidence":0.55,"triage":{"at":"2026-11-04T23:09:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"VitaFit cloud API: any logged-in user reads and overwrites other users' files","impact":"high","summary":"The VitaFit cloud API before 2026-10-30 lets any authenticated user call POST /front/user/s3/token/ and receive temporary AWS credentials. Those credentials are over-scoped, so an attacker can list the shared storage bucket and read or overwrite other users' stored files.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["vitafit","cloud-api","aws-s3"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads and overwrites other users' stored files","analyst_note":"Confirm the fixed version or vendor patch and whether the fix is live; the only linked source is a third-party VulnCheck advisory, so check it and the vendor's notice.","how_to_check":"unknown","plain_action":"unknown","needs_analyst":true,"not_affected_if":["not-a-vitafit-user"],"who_is_affected":"Anyone with a VitaFit account is in reach, because the flaw needs only an authenticated user, not special configuration. Whether a given deployment is still exposed depends on the vendor's fix, which the sources do not describe. Teams that do not use the VitaFit cloud API are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000682,"input_tokens":4282,"output_tokens":507,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version or vendor patch and whether the fix is live; the only linked source is a third-party VulnCheck advisory, so check it and the vendor's notice.","search":"'-10':40B,82C '-2026':16A,19A '-30':41B,83C '-54378':17A,20A '/front/user/s3/token':48B,104C '2026':39B,81C 'access':87C,133C 'allow':91C 'api':3A,23A,29B,37B,79C 'attack':62B,106C 'authent':44B,93C 'aw':25B,52B,98C 'aws-s3':24B 'broken':86C 'bucket':68B,118C 'call':46B,101C 'cloud':2A,22A,28B,36B,78C 'cloud-api':27B 'cognito':30B 'contain':84C 'control':88C 'credenti':53B,55B,99C,112C 'cross':130C 'cross-us':129C 'cve':15A,18A 'data':132C 'enabl':127C 'endpoint':105C 'file':14A,76B,126C 'improp':110C 'let':42B 'list':64B,114C 'log':6A 'logged-in':5A 'manipul':135C 'obtain':96C 'over-scop':57B 'overwrit':11A,72B,122C 'post':47B,103C 'read':9A,70B,120C 'receiv':50B 's3':26B 'saa':31B 'scope':59B,111C 'share':66B,116C 'storag':67B,117C 'store':75B,125C 'temporari':51B,97C 'unauthor':128C 'use':108C 'user':8A,13A,45B,74B,94C,124C,131C 'vendor':32B 'vitafit':1A,21A,33B,35B,77C 'vulner':89C","nicknames":[],"mitigations":[],"who_affected":"Anyone with a VitaFit account is in reach, because the flaw needs only an authenticated user, not special configuration. Whether a given deployment is still exposed depends on the vendor's fix, which the sources do not describe. Teams that do not use the VitaFit cloud API are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":["cloudapi","vitafitcloudapi"],"ptokens":["api","cloud","vitafit"],"labels":["awss3","cloudapi","cognito","critical","saas","vendor","vitafit"],"campaign_type":null,"first_public_at":"2026-11-04T22:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54378","severity":null,"published_at":"2026-11-04T22:18:05+00:00","modified_at":"2026-11-04T22:18:05+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","fetched_at":"2026-11-04T23:08:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-54378:1729","url":null,"severity":null,"published_at":"2026-11-04T23:10:31+00:00","modified_at":"2026-11-04T23:10:31+00:00","first_seen_at":"2026-11-04T23:10:31+00:00","fetched_at":"2026-11-04T23:10:31+00:00","note":"Only VulnCheck advisory found (credit Jose Lomeli); no vendor notice or researcher disclosure text located. Server-side cloud flaw; VulnCheck says affected = API before 2026-10-30, so fix date is implied but not vendor-confirmed. Nothing verified. Siblings: CVE-2026-54382 (over-broad s3:PutObject), -54384, -54380, Android < 2.8.1.0 CVEs."}],"documents":[{"id":71159,"url":"https://www.vulncheck.com/advisories/vitafit-cloud-api-broken-access-control-via-s3-token-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}