CVE-2026-54381

Received Received - Intake

Misconfigured Cloud Storage Bucket in VitaFit API Exposes Sensitive Files

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881 user-uploaded profile images, to access sensitive personal data without credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-54381

Affected Vendors & Products

Vendor	Product	Version / Range
Shenzhen Shine Industrial Co., Ltd.	VitaFit	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

VitaFit cloud API before 2026-10-30 had a misconfigured cloud storage bucket that allowed unauthenticated attackers to list and download stored files without credentials. The bucket contained 129,947 objects, including 126,881 user-uploaded profile images, exposing sensitive personal data.

Detection Guidance

Check for publicly accessible cloud storage buckets associated with VitaFit services. Use tools like AWS CLI or browser-based checks to list bucket contents without authentication. Look for exposed files, especially profile images or sensitive data. Example AWS CLI command: aws s3 ls s3://vitafit-bucket-name --no-sign-request

Impact Analysis

Unauthenticated attackers can access your personal data, including profile images, without any credentials. This could lead to identity theft, privacy violations, or unauthorized use of your data.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal data. GDPR requires protecting personal data, and HIPAA mandates safeguarding health-related information. The breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict public access to the VitaFit cloud storage bucket. Update the VitaFit cloud API to the patched version released after 2026-10-30. Review all stored files for unauthorized access and notify affected users if sensitive data was exposed.

Hi! I’m here to help you understand CVE-2026-54381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...