[ CVE-2026-54377 · Published 4 Nov 2026 ]
Vulnerability in Shenzhen Shine Industrial Co., Ltd. VitaFit
CVSS 6.5
No fix listed yet
[ Description ]Official description
VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different user_id or profile_id to endpoints such as GET /front/profile/{profile_id}/report/ and GET /front/profile/{profile_id}/body_index_per_day/. Attackers can leverage predictable user_id and profile_id relationships combined with an account-enumeration weakness to read another account's email address, profile, body-composition report, and measurement history at scale.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.