{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3avitafitcloud_api/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vitafit:cloud_api:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-54381"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["VitaFit cloud API (\u003c 2026-10-30)"],"_cs_severities":["high"],"_cs_tags":["cloud","misconfiguration","data-exposure","cve-2026-54381"],"_cs_type":"advisory","_cs_vendors":["VitaFit"],"content_html":"\u003cp\u003eVitaFit cloud API versions released prior to 2026-10-30 contained a cloud storage bucket misconfiguration. This vulnerability permitted unauthenticated attackers to perform directory listing and file retrieval operations against the bucket without requiring valid authentication credentials. The misconfiguration exposed 129,947 objects, including 126,881 user-uploaded profile images, potentially leaking sensitive personal information.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allowed unauthorized access to 129,947 total objects within the misconfigured storage bucket. Verified exposure includes the unauthorized retrieval of 126,881 user-uploaded profile images.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eVerify that all cloud storage buckets associated with the VitaFit environment have been audited for public read/list permissions as of 2026-10-30.\u003c/li\u003e\n\u003cli\u003eReview cloud provider audit logs (e.g., AWS CloudTrail, GCP Cloud Audit Logs, or Azure Monitor) for high volumes of \u0026quot;ListBucket\u0026quot; or \u0026quot;GetObject\u0026quot; API requests originating from unauthorized or anomalous IP addresses to detect potential data exfiltration.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T00:08:13Z","date_published":"2026-11-05T00:08:13Z","id":"https://feed.craftedsignal.io/briefs/2026-11-vitafit-cloud-storage-misconfiguration/","summary":"A misconfigured cloud storage bucket in the VitaFit cloud API allowed unauthenticated attackers to list and download sensitive user data, including over 126,000 profile images.","title":"VitaFit cloud API: Unauthenticated access via cloud storage misconfiguration (CVE-2026-54381)","url":"https://feed.craftedsignal.io/briefs/2026-11-vitafit-cloud-storage-misconfiguration/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:vitafit:cloud_api:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}