{"id":"CVE-2026-54381","kind":"vulnerability","aliases":["CVE-2026-54381"],"related":[],"title":"VitaFit cloud API: misconfigured storage bucket exposes user files publicly","description":"VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881 user-uploaded profile images, to access sensitive personal data without credentials.","summary":"VitaFit's cloud API before 2026-10-30 left a cloud storage bucket publicly accessible. Anyone can list and download its roughly 130,000 stored objects, including about 127,000 user profile images, without logging in.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-storage","personal-data","vendor","vitafit"],"not_affected_if":["not-a-vitafit-user"],"how_to_check":"- Ask the VitaFit vendor or check the service's storage bucket access settings for public listing or read permissions","fix":"- Vendor-side fix; the sources state no fixed version or setting","status":"open","published_at":"2026-11-04T23:17:48+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","triaged_at":"2026-11-05T00:31:46+00:00","updated_at":"2026-11-05T00:31:46+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-05T00:31:46Z","model":"claude-haiku-5-5","output":{"fix":"- Vendor-side fix; the sources state no fixed version or setting\n- unknown","reach":"internet","title":"VitaFit cloud API: misconfigured storage bucket exposes user files publicly","impact":"high","summary":"VitaFit's cloud API before 2026-10-30 left a cloud storage bucket publicly accessible. Anyone can list and download its roughly 130,000 stored objects, including about 127,000 user profile images, without logging in.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["vitafit","cloud-storage","personal-data"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Anyone can download user profile images and other stored personal files","analyst_note":"Find VitaFit's vendor notice or the NVD/VulnCheck page to confirm whether the bucket is closed and what the vendor says users should do.","how_to_check":"- Ask the VitaFit vendor or check the service's storage bucket access settings for public listing or read permissions\n- unknown for anything else; the sources do not describe a local check","plain_action":"If you use the VitaFit app, watch for an update or a notice from VitaFit about your data, since the vendor has to close the exposed storage.","needs_analyst":true,"not_affected_if":["not-a-vitafit-user"],"who_is_affected":"The exposure is in VitaFit's own cloud storage, so users of the VitaFit cloud service and their uploaded profile images are affected. Teams that do not use VitaFit are not exposed by this issue.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":4273,"output_tokens":577,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-10':31B,65C '-2026':12A,15A '-30':32B,66C '-54381':13A,16A '000':48B,54B '126':98C '127':53B '129':94C '130':47B '2026':30B,64C '881':99C '947':95C 'access':39B,91C,106C 'allow':75C 'anyon':40B 'api':3A,28B,62C 'attack':77C,86C 'authent':85C 'bucket':6A,37B,72C,92C 'cloud':2A,18B,27B,35B,61C,70C 'cloud-storag':17B 'contain':67C,93C 'credenti':111C 'cve':11A,14A 'data':22B,109C 'download':44B,81C 'enumer':88C 'expos':7A 'file':9A,83C 'imag':57B,104C 'includ':51B,97C 'left':33B 'list':42B,79C 'log':59B 'misconfigur':4A,69C 'object':50B,96C 'person':21B,108C 'personal-data':20B 'profil':56B,103C 'public':10A,38B,90C 'rough':46B 'sensit':107C 'storag':5A,19B,36B,71C 'store':49B,82C 'unauthent':76C 'upload':102C 'user':8A,55B,101C 'user-upload':100C 'vendor':23B 'vitafit':1A,24B,25B,60C 'vulner':73C 'without':58B,84C,110C","nicknames":[],"mitigations":[],"who_affected":"The exposure is in VitaFit's own cloud storage, so users of the VitaFit cloud service and their uploaded profile images are affected. Teams that do not use VitaFit are not exposed by this issue.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you use the VitaFit app, watch for an update or a notice from VitaFit about your data, since the vendor has to close the exposed storage.","pkeys":[],"ptokens":[],"labels":["cloudstorage","high","personaldata","vendor","vitafit"],"campaign_type":null,"first_public_at":"2026-11-04T23:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54381","severity":null,"published_at":"2026-11-04T23:17:48+00:00","modified_at":"2026-11-04T23:17:48+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","fetched_at":"2026-11-05T00:30:59+00:00","note":null}],"documents":[{"id":71476,"url":"https://www.vulncheck.com/advisories/vitafit-cloud-api-storage-bucket-unauthenticated-access-information-disclosure","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}