CVE-2026-54378

Summary

The VitaFit cloud API before 2026-10-30 exposed an endpoint that returned temporary AWS credentials with overly broad permissions to any authenticated user, bypassing intended access controls and enabling unauthorized access to other users' data in shared storage.

Exploitability

Exploitation requires only a valid authenticated session and knowledge of the vulnerable endpoint; no special tools or privileges beyond standard API access are needed.

Blast radius

Any authenticated attacker can read or overwrite any user's files in the shared storage bucket, leading to full cross-user data exposure and potential data integrity compromise.

Detection

Defenders should monitor for repeated calls to POST /front/user/s3/token/ from a single authenticated session, especially when followed by S3 ListBucket or GetObject requests to objects outside the caller's expected namespace; anomalous credential usage patterns in AWS CloudTrail logs may also indicate exploitation.

Prioritized remediation

Upgrade to VitaFit cloud API version 2026-10-30 or later, which fixes the access control flaw by properly scoping AWS credentials per user.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.