Critical 9.6

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows...

CVE-2026-54378 First seen on SecPulse Nov 5, 07:09

Affected packages

Ecosystem	Package	Affected	Fixed
Shenzhen Shine Industrial Co., Ltd.	VitaFit	< 2026-10-30	2026-10-30

Original description The description as published by the source.

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Critical 9.6; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4: Critical 9.3; CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Published: Nov 5, 2026
First seen on SecPulse: Nov 5, 07:09
GHSA: GHSA-jr4h-546g-564w
CWE: CWE-522

NVD GitHub Advisory

Tags(click for explanation)

CWE

CWE-522

All

Shenzhen Shine Industrial Co Ltd Vitafit

Detection sources

NIST National Vulnerability Database00:15
GitHub Security Advisories (Global)Nov 5, 09:33
CVE.org (CVE Program・cvelistV5)Nov 5, 07:09