{"id":"CVE-2026-54382","kind":"vulnerability","aliases":["CVE-2026-54382"],"related":[],"title":"VitaFit cloud API: authenticated users can overwrite other users' S3 files","description":"VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite other users' objects in the shared S3 bucket using credentials obtained via CVE-2026-54378, destroying original content without triggering deletion protections.","summary":"The VitaFit cloud API grants each signed-in user an AWS role that can write to the whole shared S3 bucket instead of only their own folder. An authenticated attacker can overwrite other users' objects, destroying original content.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VitaFit cloud API","fixed":["2026-10-30"],"affected":"< 2026-10-30 (date-based, server-side)","ecosystem":"vendor"}],"ecosystems":[],"tags":["aws-s3","cloud-api","cognito","mobile-app","vendor","vitafit"],"not_affected_if":["auth-required"],"how_to_check":"VitaFit's cloud API is vendor-hosted, so customers cannot inspect the Cognito role. Per VulnCheck, the flaw is in the role the API issues to signed-in users: it allows s3:PutObject on the whole shared bucket, not just the user's own folder. The paired flaw CVE-2026-54378 is the POST /front/user/s3/token/ endpoint that hands out the credentials. If you operate your own Cognito/S3 setup, check that the role policy limits s3:PutObject to a per-user prefix (e.g. ${cognito-identity.amazonaws.com:sub}). Ask the vendor to confirm that the backend build dates from 2026-10-30 or later. No vendor statement was found.","fix":"Server-side fix by the vendor: VulnCheck lists affected as 'VitaFit < 2026-10-30', which implies the cloud API is fixed from 2026-10-30. No vendor advisory or version number found, so this is unconfirmed. Nothing for end users to install.","status":"open","published_at":"2026-11-04T23:17:48+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","triaged_at":"2026-11-05T00:31:51+00:00","updated_at":"2026-11-05T00:34:06+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-05T00:31:51Z","model":"claude-haiku-5-5","output":{"fix":"- VitaFit cloud API: versions before 2026-10-30 are affected; the sources do not name a fixed version.","reach":"internet","title":"VitaFit cloud API: authenticated users can overwrite other users' S3 files","impact":"medium","summary":"The VitaFit cloud API grants each signed-in user an AWS role that can write to the whole shared S3 bucket instead of only their own folder. An authenticated attacker can overwrite other users' objects, destroying original content.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["vitafit","cognito","aws-s3"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker overwrites other users' stored files in the shared bucket","analyst_note":"Confirm the affected VitaFit version range and fixed release, and how to check the Cognito role policy; the NVD entry gives only 'before 2026-10-30'. Vulncheck advisory linked from sources may answer this.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Any team running or relying on the VitaFit cloud API with Cognito sign-in and a shared S3 bucket is exposed. The sources do not describe how to confirm the Cognito role scope on a given deployment, so the check is unknown. Exposure depends on an attacker already holding valid credentials, which the sources say can be obtained via CVE-2026-54378.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":4295,"output_tokens":557,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected VitaFit version range and fixed release, and how to check the Cognito role policy; the NVD entry gives only 'before 2026-10-30'. Vulncheck advisory linked from sources may answer this.","search":"'-10':77C '-2026':13A,16A,130C '-30':78C '-54378':131C '-54382':14A,17A '2026':76C 'access':82C 'across':101C 'allow':93C 'api':3A,20A,26B,36B,74C 'app':30B 'attack':63B,95C,114C 'authent':4A,62B,94C 'aw':22B,44B,90C 'aws-s3':21B 'bucket':54B,105C,124C 'cloud':2A,19A,25B,35B,73C 'cloud-api':24B 'cognito':27B,88C 'cognito-issu':87C 'contain':79C 'content':71B,134C 'control':83C 'credenti':126C 'cve':12A,15A,129C 'delet':137C 'destroy':69B,132C 'entir':103C 'file':11A 'folder':60B,113C 'grant':37B 'improp':81C 'instead':55B,106C 'issu':89C 'mobil':29B 'mobile-app':28B 'object':68B,119C 'obtain':127C 'oper':100C 'origin':70B,133C 'overwrit':7A,65B,116C 'perform':97C 'protect':138C 'putobject':99C 'restrict':109C 'role':45B,91C 's3':10A,23B,53B,98C,123C 'share':52B,104C,122C 'sign':40B 'signed-in':39B 'trigger':136C 'use':125C 'user':5A,9A,42B,67B,118C 'vendor':31B 'via':128C 'vitafit':1A,18A,32B,34B,72C 'vulner':84C 'whole':51B 'without':135C 'write':48B","nicknames":[],"mitigations":[],"who_affected":"VitaFit (Shenzhen Shine Industrial) cloud API users and operators whose accounts share the vendor's S3 bucket. Any signed-in user could overwrite other users' stored files, and the original content is destroyed. It needs a valid account; credentials come from CVE-2026-54378. Teams that don't use VitaFit can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["cloudapi","vitafitcloudapi"],"ptokens":["api","cloud","vitafit"],"labels":["awss3","cloudapi","cognito","high","mobileapp","vendor","vitafit"],"campaign_type":null,"first_public_at":"2026-11-04T23:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54382","severity":null,"published_at":"2026-11-04T23:17:48+00:00","modified_at":"2026-11-04T23:17:48+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","fetched_at":"2026-11-05T00:30:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-54382:1737","url":null,"severity":null,"published_at":"2026-11-05T00:34:06+00:00","modified_at":"2026-11-05T00:34:06+00:00","first_seen_at":"2026-11-05T00:34:06+00:00","fetched_at":"2026-11-05T00:34:06+00:00","note":"Only VulnCheck (third-party CNA) and aggregators found; no vendor/maintainer page, so nothing marked verified. Fix date 2026-10-30 inferred from 'affected <2026-10-30'. Sibling CVEs from the same disclosure: 54378 (critical token endpoint), 54380 (SVG XSS). Not exploited per sources; no PoC link."}],"documents":[{"id":71479,"url":"https://www.vulncheck.com/advisories/vitafit-cloud-api-aws-iam-misconfiguration-via-cognito-s3-access","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":71159,"url":"https://www.vulncheck.com/advisories/vitafit-cloud-api-broken-access-control-via-s3-token-endpoint","title":"VulnCheck: VitaFit CVE-2026-54378 S3 token endpoint","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}