---
id: "CVE-2026-54382"
kind: "vulnerability"
aliases: ["CVE-2026-54382"]
title: "VitaFit cloud API: authenticated users can overwrite other users' S3 files"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "VitaFit cloud API", "fixed": ["2026-10-30"], "affected": "< 2026-10-30 (date-based, server-side)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["aws-s3", "cloud-api", "cognito", "mobile-app", "vendor", "vitafit"]
not_affected_if: ["auth-required"]
published_at: "2026-11-04T23:17:48+00:00"
first_seen_at: "2026-11-05T00:30:59+00:00"
updated_at: "2026-11-05T00:34:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54382", "first_seen_at": "2026-11-05T00:30:59+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-05T00:34:06+00:00"}]
exploit_sources: []
---

# VitaFit cloud API: authenticated users can overwrite other users' S3 files

The VitaFit cloud API grants each signed-in user an AWS role that can write to the whole shared S3 bucket instead of only their own folder. An authenticated attacker can overwrite other users' objects, destroying original content.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VitaFit cloud API affected < 2026-10-30 (date-based, server-side) fixed 2026-10-30

## How to check

VitaFit's cloud API is vendor-hosted, so customers cannot inspect the Cognito role. Per VulnCheck, the flaw is in the role the API issues to signed-in users: it allows s3:PutObject on the whole shared bucket, not just the user's own folder. The paired flaw CVE-2026-54378 is the POST /front/user/s3/token/ endpoint that hands out the credentials. If you operate your own Cognito/S3 setup, check that the role policy limits s3:PutObject to a per-user prefix (e.g. ${cognito-identity.amazonaws.com:sub}). Ask the vendor to confirm that the backend build dates from 2026-10-30 or later. No vendor statement was found.

## Fix

Server-side fix by the vendor: VulnCheck lists affected as 'VitaFit < 2026-10-30', which implies the cloud API is fixed from 2026-10-30. No vendor advisory or version number found, so this is unconfirmed. Nothing for end users to install.

## Timeline

- 2026-11-05T00:30:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54382
- 2026-11-05T00:34:06+00:00 analyst — Only VulnCheck (third-party CNA) and aggregators found; no vendor/maintainer page, so nothing marked verified. Fix date 2026-10-30 inferred from 'affected <2026-10-30'. Sibling CVEs from the same disclosure: 54378 (critical token endpoint), 54380 (SVG XSS). Not exploited per sources; no PoC link.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vitafit-cloud-api-aws-iam-misconfiguration-via-cognito-s3-access
- [mentions] VulnCheck: VitaFit CVE-2026-54378 S3 token endpoint https://www.vulncheck.com/advisories/vitafit-cloud-api-broken-access-control-via-s3-token-endpoint

## From the sources

VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite other users' objects in the shared S3 bucket using credentials obtained via CVE-2026-54378, destroying original content without triggering deletion protections.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_