VitaFit Cloud API EUVD-2026-117155

Requires a valid authenticated VitaFit cloud account (PR:L); because the app offers normal user self-registration, this prerequisite is trivially satisfied by any attacker. The attacker then calls the specific endpoint POST /front/user/s3/token/, which returns improperly scoped temporary AWS credentials usable against the shared storage bucket. No special non-default configuration, no user interaction, and no victim action are needed; exploitation works against the cloud service as deployed prior to the 2026-10-30 fix. The only meaningful limiting factor is the need for an authenticated account and reachability of the cloud API.

This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only a single low-privilege authenticated account - and because VitaFit is a consumer fitness app with self-service registration, PR:L is a very low bar for any attacker. The scored impact (VC:H/VI:H and subsequent-system SC:H/SI:H) reflects that improperly scoped AWS credentials grant read and overwrite access across the shared bucket, affecting other users' data (a scope-changing, confidentiality- and integrity-breaking condition; no availability impact is claimed, consistent with VA:N/SA:N). The vuln.today Decision label is act_now, and the issue was reported by VulnCheck, which raises credibility. Signals that temper urgency: this is NOT listed in CISA KEV, no EPSS exploitation-probability score was provided, and the public PoC is a GitHub research reference that is not verified as working exploit code. So exploitation is assessed as a strong, low-effort possibility backed by a published advisory and research repo, but there is no evidence of active in-the-wild exploitation at time of analysis.

An attacker registers or uses any ordinary VitaFit account, authenticates to the cloud API, and calls POST /front/user/s3/token/ to receive temporary AWS credentials that are scoped too broadly. Using those credentials they list the shared storage bucket and read or overwrite files belonging to other users, achieving cross-user data theft and tampering. A public PoC reference exists (a VulnCheck/GitHub security-research repo); it is not verified as working exploit code.