{"metadata": {"vulnerability": "CVE-2026-54378", "count": 19, "kinds": {"milestone": 4, "sighting": 6, "kev": 0, "other": 9}, "linked_omitted": 0}, "data": [{"timestamp": "2026-06-12T20:20:02.949Z", "date_only": false, "value": "2026-06-12T20:20:02.949Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-54378", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-03T00:00:00Z", "date_only": false, "value": "2026-11-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-54378", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-04T22:09:16.025Z", "date_only": false, "value": "2026-11-04T22:09:16.025Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-54378", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-04T22:09:16.025Z", "date_only": false, "value": "2026-11-04T22:09:16.025Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-54378", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-04T22:14:16.733Z", "date_only": false, "value": "2026-11-04T22:14:16.733612Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117560472780814098", "record": "CVE-2026-54378", "field": "creation_timestamp", "uuid": "5329b934-289a-4d4c-b2d0-889797881a11", "content": "CVE-2026-54378 VitaFit Cloud API Broken Access Control via S3 Token Endpoint VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.\nhttps://www.cve.org/CVERecord?id=CVE-2026-54378https://github.com/je-lv/vitafit-security-researchhttps://play.google.com/store/apps/details?id=com.vt.vitafithttps://www.vulncheck.com/advisories/vitafit-cloud-api-broken-access-control-via-s3-token-endpoint#ShenzhenShineIndustrialCo.,Ltd. #VitaFit#CVE_2026_54378#bot", "url": "https://infosec.exchange/users/cve/statuses/117560472780814098"}, {"timestamp": "2026-11-04T22:18:05Z", "date_only": false, "value": "2026-11-04T22:18:05Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JR4H-546G-564W", "record": "GHSA-JR4H-546G-564W", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-04T22:18:05.777Z", "date_only": false, "value": "2026-11-04T22:18:05.777", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54378", "record": "FKIE_CVE-2026-54378", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-04T22:27:55.092Z", "date_only": false, "value": "2026-11-04T22:27:55.092418Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117560526405523402", "record": "CVE-2026-54378", "field": "creation_timestamp", "uuid": "f0b24124-cc48-420e-87f6-3935cfaa3827", "content": "CVE-2026-54382 VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite other users' objects in the shared S3 bucket using credentials obtained via CVE-2026-54378, destroying original content without triggering deletion protections.\nhttps://www.cve.org/CVERecord?id=CVE-2026-54382https://github.com/je-lv/vitafit-security-researchhttps://play.google.com/store/apps/details?id=com.vt.vitafithttps://www.vulncheck.com/advisories/vitafit-cloud-api-aws-iam-misconfiguration-via-cognito-s3-access#ShenzhenShineIndustrialCo.,Ltd. #VitaFit#CVE_2026_54382#bot", "url": "https://infosec.exchange/users/cve/statuses/117560526405523402"}, {"timestamp": "2026-11-04T23:10:02.956Z", "date_only": false, "value": "2026-11-04T23:10:02.956310Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzjhxcxigu22", "record": "CVE-2026-54378", "field": "creation_timestamp", "uuid": "da79293c-7934-49fd-a8cb-7929946a370d", "content": "CVE-2026-54378 - vitafit\nIn the VitaFit cloud service, any user who has logged in can request a special token that gives them temporary cloud storage credentials. With those credentials they can view, change, or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vitafit #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzjhxcxigu22"}, {"timestamp": "2026-11-05T00:07:58.357Z", "date_only": false, "value": "2026-11-05T00:07:58.357901Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzjl6velk52y", "record": "CVE-2026-54378", "field": "creation_timestamp", "uuid": "07cc0b53-ed68-4a17-9973-d4520dba00c0", "content": "\ud83d\udea8 CVE-2026-54378 \u2014 CVSS 9.3 CRITICAL\n\nVitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authent...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-54378\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzjl6velk52y"}, {"timestamp": "2026-11-05T00:33:06Z", "date_only": false, "value": "2026-11-05T00:33:06Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JR4H-546G-564W", "record": "GHSA-JR4H-546G-564W", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T00:33:06Z", "date_only": false, "value": "2026-11-05T00:33:06Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JR4H-546G-564W", "record": "GHSA-JR4H-546G-564W", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T02:16:24.578Z", "date_only": false, "value": "2026-11-05T02:16:24.578669Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eventmonitor.bsky.social/post/3mzmp7e6wvora", "record": "CVE-2026-54378", "field": "creation_timestamp", "uuid": "030143bb-ccd7-488b-b81f-a2157ae1600a", "content": "Developing: Critical Vulnerability (CVE-2026-54378)\nhttps://cyber.eventmonitor.net/incident/EM-20261105-CH5Y/\n#news #cybersecurity", "url": "https://bsky.app/profile/eventmonitor.bsky.social/post/3mzmp7e6wvora"}, {"timestamp": "2026-11-09T16:36:09.401Z", "date_only": false, "value": "2026-11-09T16:36:09.401768Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54378", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-09T16:36:09.401Z", "date_only": false, "value": "2026-11-09T16:36:09.401768Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54378", "record": "FKIE_CVE-2026-54378", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-09T16:56:29.658Z", "date_only": false, "value": "2026-11-09T16:56:29.658Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-54378", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-09T16:56:29.658Z", "date_only": false, "value": "2026-11-09T16:56:29.658Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54378", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T17:17:30.667Z", "date_only": false, "value": "2026-11-09T17:17:30.667", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54378", "record": "FKIE_CVE-2026-54378", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-09T21:24:03.547Z", "date_only": false, "value": "2026-11-09T21:24:03.547149Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3geygv2l2omir", "record": "CVE-2026-54378", "field": "creation_timestamp", "uuid": "f3dc5ab7-5673-44ec-940c-2828cd600668", "content": "\ud83d\udea8 CVE-2026-54378\nCVSS 9.6 / EPSS 0.23% / KEV: No\nTL;DR: VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling\u2026\nhttps://cvesentinel.com/report/CVE-2026-54378\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3geygv2l2omir"}], "metrics": {"as_of": "2026-11-12T02:36:26.972Z", "anchors": {"origin": {"timestamp": "2026-11-03T00:00:00Z", "date_only": false, "value": "2026-11-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-54378", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-03T00:00:00Z", "date_only": false, "value": "2026-11-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-54378", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 786986.972182, "hours": 218.6074922727778, "days": 9.108645511365742, "min_seconds": 700586.972182, "max_seconds": 786986.972182, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-03T00:00:00Z", "date_only": false, "value": "2026-11-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-54378", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-12T02:36:26.972Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}