VitaFit cloud API flaws expose and alter other users' data
Other people's health records can be stolen from the fitness app's server!
Summary
Several flaws in the VitaFit fitness app's cloud API let logged-in users, and sometimes outsiders, read other users' emails, profiles, body-composition reports and measurement history. Versions before 2026-10-30 are affected, and some flaws also let attackers overwrite other users' files or log in as them.
Affected when
- VitaFit cloud API before 2026-10-30
What to do
We have not confirmed a fixed version yet. Check the source links below.
Products and platforms
CVE IDs
Sources
- Write-up: vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
- Repository: github.com (opens in a new tab)
Times
First published
First seen