---
id: "CVE-2026-54378"
kind: "vulnerability"
aliases: ["CVE-2026-54378"]
title: "VitaFit cloud API: any logged-in user reads and overwrites other users' files"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "VitaFit cloud API", "fixed": [], "affected": "< 2026-10-30", "ecosystem": "vendor"}]
ecosystems: []
tags: ["aws-s3", "cloud-api", "cognito", "saas", "vendor", "vitafit"]
not_affected_if: ["not-a-vitafit-user"]
published_at: "2026-11-04T22:18:05+00:00"
first_seen_at: "2026-11-04T23:08:48+00:00"
updated_at: "2026-11-04T23:10:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54378", "first_seen_at": "2026-11-04T23:08:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T23:10:31+00:00"}]
exploit_sources: []
---

# VitaFit cloud API: any logged-in user reads and overwrites other users' files

The VitaFit cloud API before 2026-10-30 lets any authenticated user call POST /front/user/s3/token/ and receive temporary AWS credentials. Those credentials are over-scoped, so an attacker can list the shared storage bucket and read or overwrite other users' stored files.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VitaFit cloud API affected < 2026-10-30 fixed no fixed version listed

## How to check

Nothing to check on your side: this is in the vendor's cloud API, not software you run. VulnCheck's page gives no test for whether the fix is live. Also check if you use the VitaFit Android app and update it to 2.8.1.0 or later (fixes sibling CVEs, not confirmed for this one).

## Fix

Server-side change by the vendor; VulnCheck lists the API as affected before 2026-10-30. Vendor confirmation not found. No customer action known except app updates; Android app fixes for sibling CVEs are in 2.8.1.0.

## Timeline

- 2026-11-04T23:08:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54378
- 2026-11-04T23:10:31+00:00 analyst — Only VulnCheck advisory found (credit Jose Lomeli); no vendor notice or researcher disclosure text located. Server-side cloud flaw; VulnCheck says affected = API before 2026-10-30, so fix date is implied but not vendor-confirmed. Nothing verified. Siblings: CVE-2026-54382 (over-broad s3:PutObject), -54384, -54380, Android < 2.8.1.0 CVEs.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vitafit-cloud-api-broken-access-control-via-s3-token-endpoint

## From the sources

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_