VitaFit Cloud API Broken Access Control via S3 Token Endpoint

Summary

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.

Remediation

1. Inventory every Shenzhen Shine Industrial Co., Ltd. VitaFit deployment, including staging.
2. Upgrade Shenzhen Shine Industrial Co., Ltd. VitaFit to 2026-10-30.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://www.vulncheck.com/advisories/vitafit-cloud-api-broken-access-control-via-s3-token-endpoint
• Referencehttps://github.com/je-lv/vitafit-security-research
• Referencehttps://play.google.com/store/apps/details?id=com.vt.vitafit