Excessive Data Exposure in VitaFit Cloud API Affects User Privacy
CVE-2026-54383

7.1HIGH

Key Information:

Vendor

Shenzhen Shine Industrial Co., Ltd.

Status
Vitafit
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists

What is CVE-2026-54383?

The VitaFit Cloud API prior to October 30, 2026, presents an excessive data exposure vulnerability that permits any authenticated user to access sensitive personal information through the GET /front/relation/search/ endpoint. This vulnerability allows attackers to enumerate user records, potentially disclosing personally identifiable information (PII) such as email addresses, birth dates, gender, height, weight goals, phone numbers, and Firebase UIDs. The flaw arises from inadequate access control measures, leaving user data vulnerable to unauthorized queries that can be exploited with overlapping alphanumeric search terms.

Affected Version(s)

VitaFit 0 < 2026-10-30

References

https://github.com/je-lv/vitafit-security-research
technical-descriptionexploit
https://play.google.com/store/apps/details?id=com.vt.vitafit
product
https://www.vulncheck.com/advisories/vitafit-cloud-api-ex...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jose Lomeli
.