VitaFit Cloud API EUVD-2026-117163

Requires an authenticated VitaFit identity: the attacker must hold Cognito-issued AWS credentials (PR:L), reachable over the network API (AV:N) with no user interaction. The core prerequisite is the misconfigured Cognito-issued IAM role whose policy grants s3:PutObject across the entire shared bucket rather than being restricted to the caller's own folder. Affected scope is the VitaFit cloud API before the 2026-10-30 fix. The practical, impactful attack - overwriting a SPECIFIC other user's objects - is limited by needing that victim's credentials, which the description states are obtained via CVE-2026-54378; without chaining, an attacker can still write across the shared bucket but targeting is constrained. Limiting factors: valid authentication is mandatory (not unauthenticated), impact is restricted to integrity/overwrite (no read access to others' data, no stated availability loss of the service itself), and exposure ends with the patched API.

This is a medium-severity integrity flaw (input CVSS 4.0 base 6.3), and the signals consistently point to a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable, low-complexity issue that nevertheless requires authentication (PR:L) - an attacker needs a valid VitaFit/Cognito identity, so this is not unauthenticated mass-exploitable. Impact is narrow: confidentiality and availability of the vulnerable system are N, and the only material impact is subsequent-system integrity (SI:H) - the ability to overwrite other users' objects in the shared S3 bucket. The vuln.today Decision label is 'monitor', which aligns with the limited impact and authentication requirement. No CISA KEV listing is present and no EPSS score was supplied, so widespread or automated exploitation is not indicated. A public PoC reference exists but is not verified as working exploit code. A key compounding factor is explicit in the description: practical cross-user abuse depends on obtaining another user's credentials via CVE-2026-54378, so real-world risk is gated on that chained flaw. Net: a genuine but contained integrity/data-destruction issue in a niche consumer product, not a high-urgency network-worm candidate. Note one data conflict - the 'Information Disclosure' tag contradicts the CVSS vector, which records no confidentiality impact (VC:N); this is a data-integrity/overwrite bug, not a disclosure bug.

An attacker who holds valid VitaFit Cognito credentials (and, per the description, credentials for a target account obtained via CVE-2026-54378) assumes the over-privileged AWS role and issues s3:PutObject calls against paths outside their own folder in the shared bucket. Because the role is not scoped per-user, they overwrite another user's stored objects, destroying the original content without tripping deletion protections. A public PoC reference exists; it is not verified as working exploit code.