Dashboard / CVE-2026-54383

CVE-2026-54383

HIGH
MEDIUM Priority: 0.02 BB Relevance: 64/100
Published: 2026-11-04 Modified: 2026-11-09 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: None
VA: None

Description

VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using overlapping alphanumeric search terms to harvest identifiers, emails, birthdays, gender, height, weight goals, phone numbers, and Firebase UIDs.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Shenzhen Shine Industrial Co., Ltd. VitaFit 0 < 2026-10-30
Shenzhen Shine Industrial Co., Ltd. VitaFit 0 < 2026-10-30

References & Advisories (3)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.23%
Raw Score 0.002310
Percentile 14.0%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00231
2026-11-12
0.00231
2026-11-10
0.00231
2026-11-09
0.00231
2026-11-08
0.00231
2026-11-07
0.00231
2026-11-06
0.00231
2026-11-05
0.00231

Intelligence Sources

mitre ref →
nvd ref →

External Links