---
id: "CVE-2026-54383"
kind: "vulnerability"
aliases: ["CVE-2026-54383"]
title: "VitaFit cloud API leaks user health and contact records to any logged-in user"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "VitaFit cloud API", "fixed": ["2026-10-30"], "affected": "< 2026-10-30", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cloud-api", "health-data", "idor", "vendor", "vitafit"]
not_affected_if: ["unknown"]
published_at: "2026-11-04T23:17:48+00:00"
first_seen_at: "2026-11-05T00:31:00+00:00"
updated_at: "2026-11-05T00:32:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54383", "first_seen_at": "2026-11-05T00:31:00+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-05T00:32:53+00:00"}]
exploit_sources: []
---

# VitaFit cloud API leaks user health and contact records to any logged-in user

The VitaFit cloud API before 2026-10-30 exposes its GET /front/relation/search/ endpoint to any authenticated user. An attacker can enumerate the user directory with overlapping search terms and collect emails, phone numbers, birthdays, height, weight goals and Firebase UIDs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VitaFit cloud API affected < 2026-10-30 fixed 2026-10-30

## How to check

Not checkable by users: it is a vendor-hosted API. Only the VitaFit operator can confirm the GET /front/relation/search/ endpoint now restricts results to the caller's authorized relations. If you used the VitaFit app, treat your email, phone, birthday and weight data as possibly exposed.

## Fix

Hosted VitaFit cloud API dated 2026-10-30 or later is not affected per VulnCheck; server-side fix by vendor, no customer action known. Vendor notice not found.

## Timeline

- 2026-11-05T00:31:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54383
- 2026-11-05T00:32:53+00:00 analyst — Only VulnCheck advisory (CNA, third-party) read; no vendor notice found/linked. Cloud API, fixed server-side as of 2026-10-30 per VulnCheck; no client version to update. Nothing verified.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vitafit-cloud-api-excessive-data-exposure-via-relation-search-endpoint

## From the sources

VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using overlapping alphanumeric search terms to harvest identifiers, emails, birthdays, gender, height, weight goals, phone numbers, and Firebase UIDs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_