Insecure Direct Object Reference in VitaFit Cloud API by VitaFit
CVE-2026-54377

6.9MEDIUM

Key Information:

Vendor

Shenzhen Shine Industrial Co., Ltd.

Status
Vitafit
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists

What is CVE-2026-54377?

The VitaFit Cloud API prior to October 30, 2026, is susceptible to an insecure direct object reference vulnerability. This flaw permits authenticated adversaries to manipulate user_id and profile_id parameters, enabling access to sensitive data from other users' profiles. Endpoints like GET /front/profile/{profile_id}/report/ and GET /front/profile/{profile_id}/body_index_per_day/ can be exploited to enumerate user accounts, revealing private information including email addresses, body-composition reports, and measurement histories. The combination of predictable identifiers and account enumeration weaknesses amplifies the risk of large-scale data exposure.

Affected Version(s)

VitaFit 0 < 2026-10-30

References

https://github.com/je-lv/vitafit-security-research
technical-descriptionexploit
https://play.google.com/store/apps/details?id=com.vt.vitafit
product
https://www.vulncheck.com/advisories/vitafit-cloud-api-id...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jose Lomeli
.