VITAFIT CLOUD API · CVE-2026-54383 · Vendor
FIX → 2026-10-30
The VitaFit cloud API before 2026-10-30 exposes its GET /front/relation/search/ endpoint to any authenticated user. An attacker can enumerate the user directory with overlapping search terms and collect emails, phone numbers, birthdays, height, weight goals and Firebase UIDs.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Users of the VitaFit app whose accounts were on the vendor's cloud API before 2026-10-30. Any logged-in account could search other users and read emails, phone numbers, birthdays, gender, height, weight goals and Firebase UIDs. Teams not using VitaFit can skip it.
Not affected if unknown
Who cares cloud-api, health-data, idor, vitafit
Upgrade to 2026-10-30
VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using overlapping alphanumeric search terms to harvest identifiers, emails, birthdays, gender, height, weight goals, phone numbers, and Firebase UIDs.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.