CVE-2026-54382

Name of the Vulnerable Software and Affected Versions VitaFit cloud API versions prior to 2026-10-30

Description An improper access control issue exists in the Cognito-issued AWS role. This allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket rather than being restricted to their own specific folder. Consequently, attackers can overwrite objects belonging to other users in the shared S3 bucket, which results in the destruction of original content without triggering deletion protections.

Recommendations Update VitaFit cloud API to a version released on or after 2026-10-30.