BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-54378VitaFit Cloud API Broken Access Control via S3 Token Endpoint

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.

9.3 CRITICALEPSS 0.23%Not in KEVNVD: Deferred

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
9.3CRITICAL4.0VulnCheck (CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
9.6CRITICAL3.1VulnCheck (CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Details

CVE ID
CVE-2026-54378
Status
Deferred
Assigner (CNA)
VulnCheck
Published
Nov 4, 2026
Last modified
2026-11-05 15:15 UTC
Weaknesses
  • CWE-522 · Insufficiently Protected Credentials

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:16 UTC.