CVE-2026-54377 Details
Description
VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different user_id or profile_id to endpoints such as GET /front/profile/{profile_id}/report/ and GET /front/profile/{profile_id}/body_index_per_day/. Attackers can leverage predictable user_id and profile_id relationships combined with an account-enumeration weakness to read another account's email address, profile, body-composition report, and measurement history at scale.
A vulnerability allowing insecure direct object reference has been identified in the VitaFit cloud API, affecting versions prior to 2026-10-30. This vulnerability enables authenticated attackers to access another user's data by manipulating user_id or profile_id parameters in specific endpoints. The issue arises from a lack of proper authorization checks, allowing cross-account data access. Exploitation is feasible at scale due to predictable relationships between user and profile identifiers, combined with an account enumeration weakness that exposes email addresses and health-related data.
VitaFit has implemented server-side changes to deny cross-account access to the affected endpoints. The endpoints that allowed this vulnerability have been removed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/je-lv/vitafit-security-research | [email protected] | BundleTechnical Analysis |
| https://play.google.com/store/apps/details?id=com.vt.vitafit | [email protected] | ProductVendor |
| https://www.vulncheck.com/advisories/vitafit-cloud-api-idor-via-profile-id-endpoints | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| VitaFit | < 2026-10-30 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |