PT-2026-137213
CVE-2026-54378
·
Published
2026-11-04
·
Updated
2026-11-04
Description by
CVSS 3.1
9.6
CriticalMetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
VitaFit cloud API versions prior to 2026-10-30
Description
Broken access control allows authenticated users to obtain temporary AWS credentials via the 'POST /front/user/s3/token/' endpoint. These credentials have overly broad scopes, enabling attackers to list the shared storage bucket and read or overwrite files belonging to other users, leading to unauthorized cross-user data access and manipulation.
Recommendations
Update to the version released on 2026-10-30.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾