VITAFIT CLOUD API · CVE-2026-54382 · Vendor
FIX → 2026-10-30
The VitaFit cloud API grants each signed-in user an AWS role that can write to the whole shared S3 bucket instead of only their own folder. An authenticated attacker can overwrite other users' objects, destroying original content.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
VitaFit (Shenzhen Shine Industrial) cloud API users and operators whose accounts share the vendor's S3 bucket. Any signed-in user could overwrite other users' stored files, and the original content is destroyed. It needs a valid account; credentials come from CVE-2026-54378. Teams that don't use VitaFit can skip it.
Not affected if auth-required
Who cares aws-s3, cloud-api, cognito, mobile-app, vitafit
Upgrade to 2026-10-30
VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite other users' objects in the shared S3 bucket using credentials obtained via CVE-2026-54378, destroying original content without triggering deletion protections.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
VitaFit < 2026-10-30NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.