CVE-2026-54382
Description
A flaw was found in the VitaFit cloud API. An authenticated remote attacker can exploit overly permissive Amazon Web Services (AWS) role permissions to upload files across an entire shared Amazon Simple Storage Service (S3) bucket rather than remaining restricted to their designated folder. This allows an attacker to overwrite other users' stored data, leading to unauthorized data modification and loss of original content.
Statement
This vulnerability is rated as having an Important severity due to the potential for remote authenticated attackers to overwrite storage assets across tenant boundaries, resulting in significant integrity compromise without requiring administrative rights. Red Hat products do not ship or maintain the VitaFit application or its backend cloud services, meaning standard Red Hat environments are not affected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
