Is CVE-2026-54381 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-54381?

CVE-2026-54381 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-54381

Description

VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881 user-uploaded profile images, to access sensitive personal data without credentials.