CVE-2026-54378 is a critical broken access control flaw in the VitaFit cloud API: any authenticated user can get temporary AWS credentials that let them read or overwrite other users' stored files.
What Is It
The VitaFit cloud API before 2026-10-30 had a broken access control flaw in its POST /front/user/s3/token/ endpoint. Any authenticated user could call this endpoint and receive temporary AWS credentials. Those credentials were improperly scoped. They allowed the holder to list the shared storage bucket and to read or overwrite files belonging to other users. VulnCheck classifies the weakness as CWE-522 (Insufficiently Protected Credentials).
Why It Matters
VulnCheck rates the flaw CVSS 3.1 9.6 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, and CVSS 4.0 9.3 (Critical). It can be exploited over the network with low attack complexity. It needs only a low-privilege account and no user interaction. The scope is changed, and the impact on confidentiality and integrity is high. According to the advisory, a single ordinary account appears to have been enough to reach the shared bucket broadly. That would likely give an attacker unauthorized access to, and the ability to change, data belonging to other users, not just their own.
The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the supplied data does not confirm exploitation in the wild. The CVSS 4.0 exploit maturity field is "Not Defined."
What's Vulnerable
- Vendor: Shenzhen Shine Industrial Co., Ltd.
- Product: VitaFit (cloud API)
- Affected: Service versions dated before 2026-10-30
The CNA tags the record exclusively-hosted-service. The flaw is in the vendor's cloud backend, not in software that customers install. NVD lists no affected CPEs. The NVD record has status "Received" and has not been analyzed by NVD yet.
Patch Status
The affected range ends at 2026-10-30, which suggests the vendor fixed the service on or around that date, though the supplied data does not independently confirm the fix. Because the service is vendor-hosted, end users have nothing to patch themselves. The supplied data includes no vendor advisory or user remediation guidance. CISA has issued no required action because the CVE is not in KEV. Users of the VitaFit app who are worried about past exposure of their stored data should check the VulnCheck advisory and the researcher's write-up below.