Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-54381VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure

High 7.5

In plain English

A high-severity incorrect permission assignment in VitaFit from Shenzhen Shine Industrial Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 63.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881 user-uploaded profile images, to access sensitive personal data without credentials.

Affected products (as reported)

Vendor	Product	Versions
Shenzhen Shine Industrial Co., Ltd.	VitaFit	0 – before 2026-10-30

Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Researcher Disclosure technical-description, exploit
Google Play product
VulnCheck Advisory: VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure third-party-advisory