VitaFit Cloud API CVE-2026-54383

Requires a valid authenticated VitaFit cloud account (PR:L); any such account can invoke GET /front/relation/search/ against other users' records with no special configuration or user interaction. The practical limiting factor is account acquisition - exploitation is trivial wherever accounts are self-registerable through the VitaFit app, and is bounded to versions before the 2026-10-30 cloud API build, which fixes it. Only confidentiality is affected; the endpoint returns PII and health-profile data but the flaw does not permit modification or denial of service.

Signals are consistent and point to a real but moderate-priority confidentiality issue rather than an urgent one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with high confidentiality impact and no integrity or availability impact - exactly matching CWE-862 (Missing Authorization) and the described excessive data exposure. The vuln.today Decision label is 'monitor,' not act_now or emergency, and there is no CISA KEV listing, so this is 'no public exploit identified at time of analysis' as working code - though a public PoC/research reference exists (see exploitation conditions). No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. The PR:L requirement is the key moderating factor: an attacker must first hold a valid authenticated account, which caps this below an unauthenticated mass-harvest scenario, but because any authenticated user can enumerate other users' records, the barrier is low where accounts are self-registerable. Net: a genuine privacy/PII exposure worth remediating, but the 'monitor' decision and absence of KEV/verified exploit argue against treating it as an emergency.

An attacker registers or obtains a normal authenticated VitaFit account and repeatedly calls GET /front/relation/search/ with overlapping alphanumeric search terms, walking the user directory. Over successive queries they harvest other users' emails, phone numbers, birthdays, gender, height, weight goals, and Firebase UIDs. A public research/PoC reference exists but is not verified as working exploit code; exploitation is low-complexity (AC:L) and needs no user interaction.