Improper Access Control in VitaFit Cloud API Affects AWS Role Management
CVE-2026-54382

6.3MEDIUM

Key Information:

Vendor

Shenzhen Shine Industrial Co., Ltd.

Status
Vitafit
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists

What is CVE-2026-54382?

The VitaFit Cloud API prior to version 2026-10-30 harbors a significant improper access control flaw linked to its Cognito-issued AWS role. This vulnerability enables authenticated attackers to execute s3:PutObject operations across a shared S3 bucket. Instead of being confined to their designated folders, perpetrators can overwrite other users' objects, effectively destroying original contents. This exploit can be further exacerbated by credentials obtained through an associated vulnerability, allowing for unauthorized data manipulation without activating any deletion safeguards.

Affected Version(s)

VitaFit 0 < 2026-10-30

References

https://github.com/je-lv/vitafit-security-research
technical-descriptionexploit
https://play.google.com/store/apps/details?id=com.vt.vitafit
product
https://www.vulncheck.com/advisories/vitafit-cloud-api-aw...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jose Lomeli
.