CVE-2026-54377

Received Received - Intake

Insecure Direct Object Reference in VitaFit Cloud API

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different user_id or profile_id to endpoints such as GET /front/profile/{profile_id}/report/ and GET /front/profile/{profile_id}/body_index_per_day/. Attackers can leverage predictable user_id and profile_id relationships combined with an account-enumeration weakness to read another account's email address, profile, body-composition report, and measurement history at scale.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-54377

Affected Vendors & Products

Vendor	Product	Version / Range
Shenzhen Shine Industrial Co., Ltd.	VitaFit	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

VitaFit cloud API before 2026-10-30 had an insecure direct object reference flaw. Authenticated attackers could access another user's data by changing user_id or profile_id in API endpoints like GET /front/profile/{profile_id}/report/. Attackers exploited predictable ID relationships and account-enumeration weaknesses to read emails, profiles, body-composition reports, and measurement history.

Detection Guidance

Detect this vulnerability by monitoring API endpoints for unauthorized access attempts. Check logs for GET requests to /front/profile/{profile_id}/report/ and /front/profile/{profile_id}/body_index_per_day/ with varying user_id or profile_id values. Look for repeated requests with sequential or predictable IDs.

Impact Analysis

If you use VitaFit cloud services, attackers could steal your personal health data, profile information, and activity history. This could lead to privacy violations, identity theft, or misuse of sensitive health metrics. The vulnerability allows large-scale data access due to predictable ID patterns.

Compliance Impact

This vulnerability likely violates GDPR (data protection) and HIPAA (health data privacy) by enabling unauthorized access to personal and health information. It demonstrates poor security controls, risking non-compliance with privacy requirements for handling sensitive user data.

Mitigation Strategies

Update VitaFit cloud API to version 2026-10-30 or later. Implement proper authentication and authorization checks to ensure users can only access their own data. Restrict direct object references by validating user_id and profile_id against the authenticated user's session.

Hi! I’m here to help you understand CVE-2026-54377. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...