{"id":"CVE-2026-54383","kind":"vulnerability","aliases":["CVE-2026-54383"],"related":[],"title":"VitaFit cloud API leaks user health and contact records to any logged-in user","description":"VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using overlapping alphanumeric search terms to harvest identifiers, emails, birthdays, gender, height, weight goals, phone numbers, and Firebase UIDs.","summary":"The VitaFit cloud API before 2026-10-30 exposes its GET /front/relation/search/ endpoint to any authenticated user. An attacker can enumerate the user directory with overlapping search terms and collect emails, phone numbers, birthdays, height, weight goals and Firebase UIDs.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VitaFit cloud API","fixed":["2026-10-30"],"affected":"< 2026-10-30","ecosystem":"vendor"}],"ecosystems":[],"tags":["cloud-api","health-data","idor","vendor","vitafit"],"not_affected_if":["unknown"],"how_to_check":"Not checkable by users: it is a vendor-hosted API. Only the VitaFit operator can confirm the GET /front/relation/search/ endpoint now restricts results to the caller's authorized relations. If you used the VitaFit app, treat your email, phone, birthday and weight data as possibly exposed.","fix":"Hosted VitaFit cloud API dated 2026-10-30 or later is not affected per VulnCheck; server-side fix by vendor, no customer action known. Vendor notice not found.","status":"open","published_at":"2026-11-04T23:17:48+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","triaged_at":"2026-11-05T00:31:56+00:00","updated_at":"2026-11-05T00:32:53+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-05T00:31:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"VitaFit cloud API leaks user health and contact records to any logged-in user","impact":"high","summary":"The VitaFit cloud API before 2026-10-30 exposes its GET /front/relation/search/ endpoint to any authenticated user. An attacker can enumerate the user directory with overlapping search terms and collect emails, phone numbers, birthdays, height, weight goals and Firebase UIDs.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["vitafit","cloud-api","health-data"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker harvests personal and health profile data across the user directory","analyst_note":"Confirm which VitaFit API versions or hosted dates are fixed and whether the vendor has published a notice; the NVD record and the VulnCheck advisory are the sources to check.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Anyone with a VitaFit account is exposed if the cloud API is running the vulnerable version, since any authenticated user can query the search endpoint. The sources do not state which VitaFit versions or deployments are fixed, nor whether the vendor has already patched the hosted service.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":4298,"output_tokens":499,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm which VitaFit API versions or hosted dates are fixed and whether the vendor has published a notice; the NVD record and the VulnCheck advisory are the sources to check.","search":"'-10':40B,79C '-2026':17A,20A '-30':41B,80C '-54383':18A,21A '/front/relation/search':45B,96C '2026':39B,78C 'allow':88C 'alphanumer':118C 'api':3A,24A,27B,37B,76C 'attack':52B,110C 'authent':49B,90C 'birthday':67B,125C 'cloud':2A,23A,26B,36B,75C 'cloud-api':25B 'collect':63B 'contact':8A 'contain':81C 'cve':16A,19A 'data':30B,84C 'directori':57B,115C 'email':64B,124C 'endpoint':46B,97C 'enumer':54B,112C 'excess':83C 'expos':42B 'exposur':85C 'firebas':72B,133C 'gender':126C 'get':44B,95C 'goal':70B,129C 'harvest':122C 'health':6A,29B,103C 'health-data':28B 'health-rel':102C 'height':68B,127C 'identifi':123C 'idor':31B 'inform':106C 'leak':4A 'log':13A 'logged-in':12A 'number':66B,131C 'overlap':59B,117C 'phone':65B,130C 'pii':100C 'profil':105C 'queri':93C 'record':9A,109C 'relat':104C 'retriev':99C 'search':60B,119C 'term':61B,120C 'uid':73B,134C 'use':116C 'user':5A,15A,50B,56B,91C,108C,114C 'vendor':32B 'vitafit':1A,22A,33B,35B,74C 'vulner':86C 'weight':69B,128C","nicknames":[],"mitigations":[],"who_affected":"Users of the VitaFit app whose accounts were on the vendor's cloud API before 2026-10-30. Any logged-in account could search other users and read emails, phone numbers, birthdays, gender, height, weight goals and Firebase UIDs. Teams not using VitaFit can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":["cloudapi","vitafitcloudapi"],"ptokens":["api","cloud","vitafit"],"labels":["cloudapi","healthdata","high","idor","vendor","vitafit"],"campaign_type":null,"first_public_at":"2026-11-04T23:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54383","severity":null,"published_at":"2026-11-04T23:17:48+00:00","modified_at":"2026-11-04T23:17:48+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","fetched_at":"2026-11-05T00:31:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-54383:1736","url":null,"severity":null,"published_at":"2026-11-05T00:32:53+00:00","modified_at":"2026-11-05T00:32:53+00:00","first_seen_at":"2026-11-05T00:32:53+00:00","fetched_at":"2026-11-05T00:32:53+00:00","note":"Only VulnCheck advisory (CNA, third-party) read; no vendor notice found/linked. Cloud API, fixed server-side as of 2026-10-30 per VulnCheck; no client version to update. Nothing verified."}],"documents":[{"id":71480,"url":"https://www.vulncheck.com/advisories/vitafit-cloud-api-excessive-data-exposure-via-relation-search-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}