GHSA-qg7r-2qmf-p77fHighCVSS 7.5
VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability...
🔗 CVE IDs covered (1)
📋 Description
VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881 user-uploaded profile images, to access sensitive personal data without credentials.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-54381
- https://github.com/je-lv/vitafit-security-research
- https://play.google.com/store/apps/details?id=com.vt.vitafit
- https://www.vulncheck.com/advisories/vitafit-cloud-api-storage-bucket-unauthenticated-access-information-disclosure
- https://github.com/advisories/GHSA-qg7r-2qmf-p77f