# CVE-2026-54383: VitaFit cloud API information disclosure via unauthenticated search

Source: https://junglewise.ai/threats/cve-2026-54383-vitafit-cloud-api-before-2026-10-30-contained-an-excessive-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-54383 · Severity: medium · CVSS 6.5 · Published 2026-11-04

VitaFit is a smart-scale platform with mobile apps that sync health and account data to cloud services. An authenticated user can query the cloud API's search endpoint to retrieve sensitive personally identifiable and health information for any user in the system, including emails, phone numbers, birthdays, and fitness metrics. An attacker can enumerate the entire user directory by leveraging this flaw to harvest identifiers and private profile data.

Technologies: [Shenzhen Shine Industrial VitaFit Cloud API](https://junglewise.ai/threats/technologies/shenzhen-shine-industrial-vitafit-cloud-api). Vendors: [Shenzhen Shine Industrial](https://junglewise.ai/threats/vendors/shenzhen-shine-industrial).

## Quick answers

**Is CVE-2026-54383 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54383 being exploited in the wild.

**How severe is CVE-2026-54383?** Medium severity, with a CVSS score of 6.5, published 4 November 2026.

**Which products and versions are affected?** Shenzhen Shine Industrial VitaFit Cloud API before 2026-10-30.

**Is there a fix for CVE-2026-54383?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-54383 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-54383?** Check whether you run Shenzhen Shine Industrial VitaFit Cloud API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The VitaFit cloud API's GET /front/relation/search/ endpoint fails to enforce proper authorization checks, allowing any authenticated user to query and retrieve PII and health profile data for arbitrary user records. An attacker can enumerate user identifiers using overlapping alphanumeric search terms to harvest emails, birthdays, gender, height, weight goals, phone numbers, and Firebase UIDs. This is an information disclosure vulnerability stemming from inadequate access control on a sensitive API endpoint.

## Affected products

- Shenzhen Shine Industrial VitaFit cloud API before 2026-10-30

## Timeline

- 2026-11-03: disclosed: Responsible disclosure published by researcher Jose Lomeli
- 2026-11-04: advisory

## References

- [https://github.com/je-lv/vitafit-security-research](https://github.com/je-lv/vitafit-security-research)
- [https://play.google.com/store/apps/details?id=com.vt.vitafit](https://play.google.com/store/apps/details?id=com.vt.vitafit)

## Related threats

- [VitaFit Cloud API broken access control in AWS credential issuance](https://junglewise.ai/threats/cve-2026-54378-vitafit-cloud-api-before-2026-10-30-contained-a-broken-access)
- [VitaFit cloud API insecure direct object reference](https://junglewise.ai/threats/cve-2026-54377-vitafit-cloud-api-before-2026-10-30-contained-an-insecure-direct)