# CVE-2026-54381: VitaFit cloud API misconfigured storage bucket

Source: https://junglewise.ai/threats/cve-2026-54381-vitafit-cloud-api-before-2026-10-30-contained-a-misconfigured  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-54381 · Severity: high · CVSS 7.5 · Published 2026-11-04

VitaFit is a fitness tracking app that syncs user health data and profile images to cloud storage. A misconfigured cloud storage bucket allowed anyone on the internet to list and download sensitive files—including over 126,000 user profile images—without any credentials or authentication. Attackers could access personal health information and images without the knowledge or permission of the affected users.

Technologies: [Shenzhen Shine Industrial VitaFit](https://junglewise.ai/threats/technologies/vitafit). Vendors: [Shenzhen Shine Industrial](https://junglewise.ai/threats/vendors/shenzhen-shine-industrial).

## Quick answers

**Is CVE-2026-54381 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54381 being exploited in the wild.

**How severe is CVE-2026-54381?** High severity, with a CVSS score of 7.5, published 4 November 2026.

**Which products and versions are affected?** Shenzhen Shine Industrial VitaFit before 2026-10-30.

**Is there a fix for CVE-2026-54381?** Yes: fixed in VitaFit (fixed by 2026-10-30). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54381 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-54381?** Check whether you run Shenzhen Shine Industrial VitaFit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in VitaFit (fixed by 2026-10-30)

## Technical details

The vulnerability is a misconfigured AWS S3 bucket that lacks proper access controls, allowing unauthenticated enumeration and object retrieval via network access. The publicly accessible bucket contained 129,947 objects including user-uploaded images and personal health data. No authentication or special preconditions are required; an attacker with network access can directly enumerate and download objects from the exposed bucket.

## Affected products

- Shenzhen Shine Industrial VitaFit before 2026-10-30

## Timeline

- 2026-11-04: disclosed
- 2026-11-03: advisory

## References

- [https://github.com/je-lv/vitafit-security-research](https://github.com/je-lv/vitafit-security-research)
- [https://play.google.com/store/apps/details?id=com.vt.vitafit](https://play.google.com/store/apps/details?id=com.vt.vitafit)

## Related threats

- [VitaFit Android app insecure session management](https://junglewise.ai/threats/cve-2026-54375-vitafit-android-application-com-vt-vitafit-before-2-8-1-0)
- [VitaFit Android application hardcoded credentials in third-party integrations](https://junglewise.ai/threats/cve-2026-54374-vitafit-android-application-com-vt-vitafit-before-2-8-1-0)
- [VitaFit Android insecure TLS/SSL certificate validation](https://junglewise.ai/threats/cve-2026-54372-vitafit-android-application-com-vt-vitafit-before-2-8-1-0)