PT-2026-137215
CVE-2026-54381
·
Published
2026-11-04
·
Updated
2026-11-04
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
VitaFit cloud API versions prior to 2026-10-30
Description
A misconfigured cloud storage bucket allows unauthenticated attackers to list and download stored files. This issue enables the enumeration of a publicly accessible bucket containing 129,947 objects, including 126,881 user-uploaded profile images, leading to unauthorized access to sensitive personal data.
Recommendations
Update VitaFit cloud API to a version released on or after 2026-10-30.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾