CVE-2026-54383

Received Received - Intake

Excessive Data Exposure in VitaFit Cloud API

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using overlapping alphanumeric search terms to harvest identifiers, emails, birthdays, gender, height, weight goals, phone numbers, and Firebase UIDs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-54383

Affected Vendors & Products

Vendor	Product	Version / Range
Shenzhen Shine Industrial Co., Ltd.	VitaFit	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an excessive data exposure flaw in the VitaFit cloud API. It allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve sensitive personal and health-related information from user records without proper access controls.

Detection Guidance

Monitor API logs for excessive queries to the GET /front/relation/search/ endpoint. Check for repeated requests with overlapping alphanumeric search terms that may indicate enumeration attempts. Review network traffic for unauthorized access to user PII or health data.

Impact Analysis

Attackers can exploit this to harvest personally identifiable information (PII) such as user identifiers, emails, birthdays, gender, health metrics, phone numbers, and Firebase UIDs. This could lead to identity theft, targeted phishing, or unauthorized access to health-related data.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to PII and HIPAA if health data is exposed, as both require strict protection of personal and health information. Organizations using this API may face legal penalties and compliance failures.

Mitigation Strategies

Update VitaFit cloud API to version 2026-10-30 or later. Restrict access to the GET /front/relation/search/ endpoint to authorized users only. Implement rate limiting to prevent enumeration attempts. Audit logs for suspicious activity and revoke any unauthorized access.

Hi! I’m here to help you understand CVE-2026-54383. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...