CVE-2026-25197

CVE-2026-25197: Authorization Bypass via User-Controlled Key IDOR Advisory Field| Value ---|--- CVE| CVE-2026-25197 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 9.1 Critical Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-639 Authorization Bypass Through User-Controlled Key Researcher|...

CVE-2026-32662

CERT/CC VU653116 | CISA Advisory ICSA-26-055-03 | All CVEs | Case Repository CVE-2026-32662: Active Debug Code in Production Advisory Field| Value ---|--- CVE| CVE-2026-32662 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 5.3 Medium Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE| CWE-489 Activ...

CVE-2026-54382

A flaw was found in the VitaFit cloud API. An authenticated remote attacker can exploit overly permissive Amazon Web Services AWS role permissions to upload files across an entire shared Amazon Simple Storage Service S3 bucket rather than remaining restricted to their designated folder. This allo...

EUVD-2026-117160

VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881...

EUVD-2026-117163

VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite oth...

EUVD-2026-117167

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownershi...

EUVD-2026-117165

VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using...

EUVD-2026-117157

VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure to restrict scripts or force downloads...

EUVD-2026-117154

VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different userid or profileid to endpoints such as GET /front/profile/profileid/report/ and GET...

EUVD-2026-117155

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket an...

CVE-2026-54383

VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using...

CVE-2026-54381

VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881...

CVE-2026-54384

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownershi...

CVE-2026-54382

VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite oth...

CVE-2026-54384

The VitaFit cloud API (prior to 2026-10-30) is vulnerable to an authentication bypass in the POST /front/login/sns/ endpoint. This flaw allows remote attackers to gain a full session for a victim's account by submitting a linked Google or Facebook account identifier without providing proof of own...

CVE-2026-54384 VitaFit Cloud API Authentication Bypass via POST /front/login/sns/

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownershi...

CVE-2026-54383 VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint

VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using...

CVE-2026-54383

The VitaFit cloud API (versions before 2026-10-30) contains an excessive data exposure vulnerability via the GET /front/relation/search/ endpoint. This flaw allows any authenticated user to perform directory enumeration by using overlapping alphanumeric search terms. Successful exploitation resul...

CVE-2026-54382 VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access

VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite oth...

CVE-2026-54382

The VitaFit cloud API contained an improper access control vulnerability in its Cognito-issued AWS role prior to 2026-10-30. This misconfiguration allows authenticated attackers to perform s3:PutObject operations across a shared S3 bucket, bypassing restrictions that should limit access to indivi...