CVE-2026-54383

Name of the Vulnerable Software and Affected Versions VitaFit cloud API versions prior to 2026-10-30

Description An excessive data exposure issue allows authenticated users to retrieve personally identifiable information (PII) and health-related profile data. By querying the 'GET /front/relation/search/' endpoint using overlapping alphanumeric search terms, attackers can enumerate the user directory to harvest emails, birthdays, gender, height, weight goals, phone numbers, Firebase UIDs, and other identifiers.

Recommendations Update VitaFit cloud API to a version released on or after 2026-10-30. Restrict access to the 'GET /front/relation/search/' endpoint to minimize the risk of data harvesting.